@wildo-ai/saas-backend-lib 1.1.8 → 1.1.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (174) hide show
  1. package/dist/esm/data-seeding/models/data-seed.shared.schemas.d.ts +8 -0
  2. package/dist/esm/data-seeding/models/data-seed.shared.schemas.d.ts.map +1 -1
  3. package/dist/esm/data-seeding/models/data-seed.shared.schemas.js +17 -0
  4. package/dist/esm/data-seeding/models/data-seed.shared.schemas.js.map +1 -1
  5. package/dist/esm/data-seeding/services/data-seed-application-bootstrap.backend.d.ts.map +1 -1
  6. package/dist/esm/data-seeding/services/data-seed-application-bootstrap.backend.js +9 -1
  7. package/dist/esm/data-seeding/services/data-seed-application-bootstrap.backend.js.map +1 -1
  8. package/dist/esm/data-seeding/services/data-seed-environment-admission.backend.d.ts +23 -0
  9. package/dist/esm/data-seeding/services/data-seed-environment-admission.backend.d.ts.map +1 -0
  10. package/dist/esm/data-seeding/services/data-seed-environment-admission.backend.js +25 -0
  11. package/dist/esm/data-seeding/services/data-seed-environment-admission.backend.js.map +1 -0
  12. package/dist/esm/databases/services/postgresql-migration-runner.backend.d.ts +6 -0
  13. package/dist/esm/databases/services/postgresql-migration-runner.backend.d.ts.map +1 -1
  14. package/dist/esm/databases/services/postgresql-migration-runner.backend.js +8 -1
  15. package/dist/esm/databases/services/postgresql-migration-runner.backend.js.map +1 -1
  16. package/dist/esm/external-providers/services/external-providers-registry.backend.service.d.ts +0 -1
  17. package/dist/esm/external-providers/services/external-providers-registry.backend.service.d.ts.map +1 -1
  18. package/dist/esm/external-providers/services/external-providers-registry.backend.service.js +4 -39
  19. package/dist/esm/external-providers/services/external-providers-registry.backend.service.js.map +1 -1
  20. package/dist/esm/flows-actors/services/agents.backend.service.d.ts +15 -4
  21. package/dist/esm/flows-actors/services/agents.backend.service.d.ts.map +1 -1
  22. package/dist/esm/flows-actors/services/agents.backend.service.js +21 -11
  23. package/dist/esm/flows-actors/services/agents.backend.service.js.map +1 -1
  24. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.d.ts +47 -2
  25. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.d.ts.map +1 -1
  26. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.js +56 -8
  27. package/dist/esm/flows-actors/utils/acp-session-runner.backend.utils.js.map +1 -1
  28. package/dist/esm/queue/job-consumer.backend.service.d.ts.map +1 -1
  29. package/dist/esm/queue/job-consumer.backend.service.js +21 -8
  30. package/dist/esm/queue/job-consumer.backend.service.js.map +1 -1
  31. package/dist/esm/queue/job-status-tracking.backend.service.d.ts.map +1 -1
  32. package/dist/esm/queue/job-status-tracking.backend.service.js +4 -1
  33. package/dist/esm/queue/job-status-tracking.backend.service.js.map +1 -1
  34. package/dist/esm/queue/queue.backend.service.d.ts +14 -0
  35. package/dist/esm/queue/queue.backend.service.d.ts.map +1 -1
  36. package/dist/esm/queue/queue.backend.service.js +68 -12
  37. package/dist/esm/queue/queue.backend.service.js.map +1 -1
  38. package/dist/esm/queue/scheduled-evidence-coverage.backend.d.ts +8 -0
  39. package/dist/esm/queue/scheduled-evidence-coverage.backend.d.ts.map +1 -1
  40. package/dist/esm/queue/scheduled-evidence-coverage.backend.js +20 -2
  41. package/dist/esm/queue/scheduled-evidence-coverage.backend.js.map +1 -1
  42. package/dist/esm/queue/scheduled-execution.backend.service.d.ts +44 -1
  43. package/dist/esm/queue/scheduled-execution.backend.service.d.ts.map +1 -1
  44. package/dist/esm/queue/scheduled-execution.backend.service.js +180 -10
  45. package/dist/esm/queue/scheduled-execution.backend.service.js.map +1 -1
  46. package/dist/esm/queue/scheduled-message-verifier.backend.service.d.ts +73 -21
  47. package/dist/esm/queue/scheduled-message-verifier.backend.service.d.ts.map +1 -1
  48. package/dist/esm/queue/scheduled-message-verifier.backend.service.js +162 -88
  49. package/dist/esm/queue/scheduled-message-verifier.backend.service.js.map +1 -1
  50. package/dist/esm/runtime/services/start-application.backend.service.d.ts.map +1 -1
  51. package/dist/esm/runtime/services/start-application.backend.service.js +16 -1
  52. package/dist/esm/runtime/services/start-application.backend.service.js.map +1 -1
  53. package/package.json +10 -10
  54. package/dist/esm/__tests__/fixture-deep-partial.d.ts +0 -18
  55. package/dist/esm/__tests__/fixture-deep-partial.d.ts.map +0 -1
  56. package/dist/esm/__tests__/fixture-deep-partial.js +0 -1
  57. package/dist/esm/__tests__/fixture-deep-partial.js.map +0 -1
  58. package/dist/esm/__tests__/integration/redis-integration-gate.d.ts +0 -26
  59. package/dist/esm/__tests__/integration/redis-integration-gate.d.ts.map +0 -1
  60. package/dist/esm/__tests__/integration/redis-integration-gate.js +0 -105
  61. package/dist/esm/__tests__/integration/redis-integration-gate.js.map +0 -1
  62. package/dist/esm/__tests__/setup.d.ts +0 -7
  63. package/dist/esm/__tests__/setup.d.ts.map +0 -1
  64. package/dist/esm/__tests__/setup.js +0 -14
  65. package/dist/esm/__tests__/setup.js.map +0 -1
  66. package/dist/esm/__tests__/test-container.d.ts +0 -41
  67. package/dist/esm/__tests__/test-container.d.ts.map +0 -1
  68. package/dist/esm/__tests__/test-container.js +0 -98
  69. package/dist/esm/__tests__/test-container.js.map +0 -1
  70. package/dist/esm/base-classes/services/__tests__/mock-resource-operation-helper.service.d.ts +0 -47
  71. package/dist/esm/base-classes/services/__tests__/mock-resource-operation-helper.service.d.ts.map +0 -1
  72. package/dist/esm/base-classes/services/__tests__/mock-resource-operation-helper.service.js +0 -82
  73. package/dist/esm/base-classes/services/__tests__/mock-resource-operation-helper.service.js.map +0 -1
  74. package/dist/esm/base-classes/services/repositories/__tests__/method-span-scan.guard-helpers.d.ts +0 -57
  75. package/dist/esm/base-classes/services/repositories/__tests__/method-span-scan.guard-helpers.d.ts.map +0 -1
  76. package/dist/esm/base-classes/services/repositories/__tests__/method-span-scan.guard-helpers.js +0 -172
  77. package/dist/esm/base-classes/services/repositories/__tests__/method-span-scan.guard-helpers.js.map +0 -1
  78. package/dist/esm/base-classes/services/repositories/__tests__/repositories-registry-infrastructure-read.double.d.ts +0 -41
  79. package/dist/esm/base-classes/services/repositories/__tests__/repositories-registry-infrastructure-read.double.d.ts.map +0 -1
  80. package/dist/esm/base-classes/services/repositories/__tests__/repositories-registry-infrastructure-read.double.js +0 -54
  81. package/dist/esm/base-classes/services/repositories/__tests__/repositories-registry-infrastructure-read.double.js.map +0 -1
  82. package/dist/esm/billing/services/__tests__/subscription-provider-projection.test-double.d.ts +0 -20
  83. package/dist/esm/billing/services/__tests__/subscription-provider-projection.test-double.d.ts.map +0 -1
  84. package/dist/esm/billing/services/__tests__/subscription-provider-projection.test-double.js +0 -33
  85. package/dist/esm/billing/services/__tests__/subscription-provider-projection.test-double.js.map +0 -1
  86. package/dist/esm/billing/services/custom-impl/__tests__/plan-change-confirmation.fixture.d.ts +0 -22
  87. package/dist/esm/billing/services/custom-impl/__tests__/plan-change-confirmation.fixture.d.ts.map +0 -1
  88. package/dist/esm/billing/services/custom-impl/__tests__/plan-change-confirmation.fixture.js +0 -92
  89. package/dist/esm/billing/services/custom-impl/__tests__/plan-change-confirmation.fixture.js.map +0 -1
  90. package/dist/esm/billing/services/custom-impl/__tests__/subscription-keyed-mutation.fixture.d.ts +0 -15
  91. package/dist/esm/billing/services/custom-impl/__tests__/subscription-keyed-mutation.fixture.d.ts.map +0 -1
  92. package/dist/esm/billing/services/custom-impl/__tests__/subscription-keyed-mutation.fixture.js +0 -61
  93. package/dist/esm/billing/services/custom-impl/__tests__/subscription-keyed-mutation.fixture.js.map +0 -1
  94. package/dist/esm/billing/services/webhooks/__tests__/billing-event-authority.test-double.d.ts +0 -21
  95. package/dist/esm/billing/services/webhooks/__tests__/billing-event-authority.test-double.d.ts.map +0 -1
  96. package/dist/esm/billing/services/webhooks/__tests__/billing-event-authority.test-double.js +0 -32
  97. package/dist/esm/billing/services/webhooks/__tests__/billing-event-authority.test-double.js.map +0 -1
  98. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.d.ts +0 -52
  99. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.d.ts.map +0 -1
  100. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.js +0 -74
  101. package/dist/esm/billing/services/webhooks/__tests__/settlement-ledger.test-double.js.map +0 -1
  102. package/dist/esm/config/services/__tests__/mock-app-configuration.service.d.ts +0 -60
  103. package/dist/esm/config/services/__tests__/mock-app-configuration.service.d.ts.map +0 -1
  104. package/dist/esm/config/services/__tests__/mock-app-configuration.service.js +0 -156
  105. package/dist/esm/config/services/__tests__/mock-app-configuration.service.js.map +0 -1
  106. package/dist/esm/config/services/__tests__/startup-validator-resources-registry.double.d.ts +0 -31
  107. package/dist/esm/config/services/__tests__/startup-validator-resources-registry.double.d.ts.map +0 -1
  108. package/dist/esm/config/services/__tests__/startup-validator-resources-registry.double.js +0 -47
  109. package/dist/esm/config/services/__tests__/startup-validator-resources-registry.double.js.map +0 -1
  110. package/dist/esm/databases/services/__tests__/mock-mongoose-model.service.d.ts +0 -20
  111. package/dist/esm/databases/services/__tests__/mock-mongoose-model.service.d.ts.map +0 -1
  112. package/dist/esm/databases/services/__tests__/mock-mongoose-model.service.js +0 -424
  113. package/dist/esm/databases/services/__tests__/mock-mongoose-model.service.js.map +0 -1
  114. package/dist/esm/databases/services/__tests__/mock-zod-mongoose-schema-convertor.service.d.ts +0 -19
  115. package/dist/esm/databases/services/__tests__/mock-zod-mongoose-schema-convertor.service.d.ts.map +0 -1
  116. package/dist/esm/databases/services/__tests__/mock-zod-mongoose-schema-convertor.service.js +0 -49
  117. package/dist/esm/databases/services/__tests__/mock-zod-mongoose-schema-convertor.service.js.map +0 -1
  118. package/dist/esm/flows-actors/services/__tests__/pending-decision.fixtures.d.ts +0 -43
  119. package/dist/esm/flows-actors/services/__tests__/pending-decision.fixtures.d.ts.map +0 -1
  120. package/dist/esm/flows-actors/services/__tests__/pending-decision.fixtures.js +0 -61
  121. package/dist/esm/flows-actors/services/__tests__/pending-decision.fixtures.js.map +0 -1
  122. package/dist/esm/inbound/services/__tests__/support/in-memory-infrastructure-repositories.d.ts +0 -25
  123. package/dist/esm/inbound/services/__tests__/support/in-memory-infrastructure-repositories.d.ts.map +0 -1
  124. package/dist/esm/inbound/services/__tests__/support/in-memory-infrastructure-repositories.js +0 -92
  125. package/dist/esm/inbound/services/__tests__/support/in-memory-infrastructure-repositories.js.map +0 -1
  126. package/dist/esm/meta-workflows/services/__tests__/fixtures/meta-workflow-evaluation-treatment.test-fixture.d.ts +0 -7
  127. package/dist/esm/meta-workflows/services/__tests__/fixtures/meta-workflow-evaluation-treatment.test-fixture.d.ts.map +0 -1
  128. package/dist/esm/meta-workflows/services/__tests__/fixtures/meta-workflow-evaluation-treatment.test-fixture.js +0 -194
  129. package/dist/esm/meta-workflows/services/__tests__/fixtures/meta-workflow-evaluation-treatment.test-fixture.js.map +0 -1
  130. package/dist/esm/monitoring/logger/services/__tests__/mock-logger.service.d.ts +0 -34
  131. package/dist/esm/monitoring/logger/services/__tests__/mock-logger.service.d.ts.map +0 -1
  132. package/dist/esm/monitoring/logger/services/__tests__/mock-logger.service.js +0 -59
  133. package/dist/esm/monitoring/logger/services/__tests__/mock-logger.service.js.map +0 -1
  134. package/dist/esm/monitoring/observability/services/__tests__/mock-metrics.service.d.ts +0 -48
  135. package/dist/esm/monitoring/observability/services/__tests__/mock-metrics.service.d.ts.map +0 -1
  136. package/dist/esm/monitoring/observability/services/__tests__/mock-metrics.service.js +0 -53
  137. package/dist/esm/monitoring/observability/services/__tests__/mock-metrics.service.js.map +0 -1
  138. package/dist/esm/notifications/services/__tests__/fixtures/personal-notification-browser/bundle.d.ts +0 -3
  139. package/dist/esm/notifications/services/__tests__/fixtures/personal-notification-browser/bundle.d.ts.map +0 -1
  140. package/dist/esm/notifications/services/__tests__/fixtures/personal-notification-browser/bundle.js +0 -19
  141. package/dist/esm/notifications/services/__tests__/fixtures/personal-notification-browser/bundle.js.map +0 -1
  142. package/dist/esm/notifications/services/__tests__/fixtures/personal-notification-browser/host.d.ts +0 -51
  143. package/dist/esm/notifications/services/__tests__/fixtures/personal-notification-browser/host.d.ts.map +0 -1
  144. package/dist/esm/notifications/services/__tests__/fixtures/personal-notification-browser/host.js +0 -24
  145. package/dist/esm/notifications/services/__tests__/fixtures/personal-notification-browser/host.js.map +0 -1
  146. package/dist/esm/notifications/services/__tests__/recipient-language.test-double.d.ts +0 -8
  147. package/dist/esm/notifications/services/__tests__/recipient-language.test-double.d.ts.map +0 -1
  148. package/dist/esm/notifications/services/__tests__/recipient-language.test-double.js +0 -9
  149. package/dist/esm/notifications/services/__tests__/recipient-language.test-double.js.map +0 -1
  150. package/dist/esm/pdf-templates/__tests__/fixtures/tiny-pdf-template.fixture.d.ts +0 -10
  151. package/dist/esm/pdf-templates/__tests__/fixtures/tiny-pdf-template.fixture.d.ts.map +0 -1
  152. package/dist/esm/pdf-templates/__tests__/fixtures/tiny-pdf-template.fixture.js +0 -18
  153. package/dist/esm/pdf-templates/__tests__/fixtures/tiny-pdf-template.fixture.js.map +0 -1
  154. package/dist/esm/security/api-keys/__tests__/api-key-usage-redis.double.d.ts +0 -11
  155. package/dist/esm/security/api-keys/__tests__/api-key-usage-redis.double.d.ts.map +0 -1
  156. package/dist/esm/security/api-keys/__tests__/api-key-usage-redis.double.js +0 -34
  157. package/dist/esm/security/api-keys/__tests__/api-key-usage-redis.double.js.map +0 -1
  158. package/dist/esm/security/authentications/__tests__/registration-onboarding.harness.d.ts +0 -105
  159. package/dist/esm/security/authentications/__tests__/registration-onboarding.harness.d.ts.map +0 -1
  160. package/dist/esm/security/authentications/__tests__/registration-onboarding.harness.js +0 -140
  161. package/dist/esm/security/authentications/__tests__/registration-onboarding.harness.js.map +0 -1
  162. package/dist/esm/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.d.ts +0 -35
  163. package/dist/esm/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.d.ts.map +0 -1
  164. package/dist/esm/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.js +0 -46
  165. package/dist/esm/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.js.map +0 -1
  166. package/dist/esm/security/connected-accounts/__tests__/support/real-connection-client-methods.d.ts +0 -2
  167. package/dist/esm/security/connected-accounts/__tests__/support/real-connection-client-methods.d.ts.map +0 -1
  168. package/dist/esm/security/connected-accounts/__tests__/support/real-connection-client-methods.js +0 -18
  169. package/dist/esm/security/connected-accounts/__tests__/support/real-connection-client-methods.js.map +0 -1
  170. package/dist/esm/systems-of-record/credentials/__tests__/certificate-fixtures.d.ts +0 -20
  171. package/dist/esm/systems-of-record/credentials/__tests__/certificate-fixtures.d.ts.map +0 -1
  172. package/dist/esm/systems-of-record/credentials/__tests__/certificate-fixtures.js +0 -56
  173. package/dist/esm/systems-of-record/credentials/__tests__/certificate-fixtures.js.map +0 -1
  174. package/dist/tsconfig.build.tsbuildinfo +0 -1
package/dist/esm/runtime/services/start-application.backend.service.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"start-application.backend.service.js","sourceRoot":"","sources":["../../../../../src/runtime/services/start-application.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sCAAsC,EAAE,MAAM,2FAA2F,CAAC;AACnJ,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAKzD,OAAO,EAAE,wCAAwC,EAAE,2BAA2B,EAAE,MAAM,kFAAkF,CAAC;AAKzK,OAAO,EACH,iCAAiC,EACjC,uCAAuC,GAC1C,MAAM,4EAA4E,CAAC;AAEpF,OAAO,EAAE,uCAAuC,EAAE,MAAM,sFAAsF,CAAC;AAC/I,OAAO,EAAE,uCAAuC,EAAE,SAAS,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,cAAc,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,cAAc,EAAE,cAAc,EAAE,2CAA2C,EACrU,wCAAwC,EAAE,4CAA4C,EAAE,kBAAkB,EAAE,qCAAqC,EAAE,sCAAsC,EAAE,8BAA8B,EAAE,sCAAsC,EAAE,0CAA0C,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnc,OAAO,EAAE,wDAAwD,EAAuC,MAAM,uBAAuB,CAAC;AACtI,OAAO,EAAE,2CAA2C,EAAuC,MAAM,uBAAuB,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAEhJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,4EAA4E,CAAC;AACpH,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4EAA4E,CAAC;AACpF,OAAO,EACL,oDAAoD,EACpD,2CAA2C,EAC3C,sCAAsC,EACtC,gCAAgC,EAChC,uCAAuC,GACxC,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,mCAAmC,EAAE,MAAM,mFAAmF,CAAC;AACxI,OAAO,EAAE,yBAAyB,EAAE,8CAA8C,EAAE,MAAM,yEAAyE,CAAC;AACpK,OAAO,EACL,mCAAmC,GAEpC,MAAM,mGAAmG,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,sBAAsB,EAAE,MAAM,6EAA6E,CAAC;AACrH,OAAO,EAAE,+BAA+B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,wCAAwC,EAAE,MAAM,yFAAyF,CAAC;AACnJ,OAAO,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AAIjI,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAG3H,OAAO,EAAE,qCAAqC,EAAE,MAAM,0FAA0F,CAAC;AACjJ,OAAO,EAAE,8BAA8B,EAAE,MAAM,wFAAwF,CAAC;AACxI,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,uCAAuC,EAAE,MAAM,kFAAkF,CAAC;AAC3I,OAAO,EAAE,yCAAyC,EAAE,MAAM,oFAAoF,CAAC;AAC/I,OAAO,EAAE,wCAAwC,EAAE,MAAM,mFAAmF,CAAC;AAK7I,OAAO,EAAE,gCAAgC,EAAE,MAAM,0EAA0E,CAAC;AAC5H,OAAO,EAAE,wCAAwC,EAAE,MAAM,+EAA+E,CAAC;AACzI,OAAO,EAAE,4BAA4B,EAAE,MAAM,8EAA8E,CAAC;AAC5H,OAAO,EAAE,oCAAoC,EAAE,MAAM,4FAA4F,CAAC;AAClJ,OAAO,EAAE,2CAA2C,EAAE,MAAM,qGAAqG,CAAC;AAClK,OAAO,EAAE,gCAAgC,EAAE,MAAM,wFAAwF,CAAC;AAC1I,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAAE,6CAA6C,EAAE,MAAM,oFAAoF,CAAC;AACnJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACpJ,OAAO,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAE7J,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AAClI,OAAO,EAAE,sCAAsC,EAAE,MAAM,4FAA4F,CAAC;AAEpJ,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,2DAA2D,EAAE,MAAM,qHAAqH,CAAC;AAClM,OAAO,EAAE,2CAA2C,EAAE,MAAM,uFAAuF,CAAC;AACpJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,kCAAkC,EAAE,MAAM,uGAAuG,CAAC;AAC3J,OAAO,EAAE,kDAAkD,EAAE,MAAM,2GAA2G,CAAC;AAC/K,OAAO,EAAE,+CAA+C,EAAE,MAAM,sGAAsG,CAAC;AACvK,OAAO,EAAE,gCAAgC,EAAE,MAAM,4FAA4F,CAAC;AAC9I,OAAO,EAAE,mCAAmC,EAAE,MAAM,2FAA2F,CAAC;AAChJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,uFAAuF,CAAC;AACzI,OAAO,EAAE,+BAA+B,EAAE,MAAM,sFAAsF,CAAC;AACvI,OAAO,EAAE,+BAA+B,EAAE,kCAAkC,EAAE,MAAM,yFAAyF,CAAC;AAC9K,OAAO,EAAE,kCAAkC,EAAE,MAAM,qGAAqG,CAAC;AACzJ,OAAO,EAAE,iCAAiC,EAAE,MAAM,iGAAiG,CAAC;AACpJ,OAAO,EAAE,4CAA4C,EAAE,MAAM,qGAAqG,CAAC;AACnK,OAAO,EAAE,gCAAgC,EAAE,MAAM,gGAAgG,CAAC;AAClJ,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,gCAAgC,EAAE,MAAM,iFAAiF,CAAC;AACnI,OAAO,EAAE,mCAAmC,EAAE,MAAM,sFAAsF,CAAC;AAC3I,OAAO,EAAE,8CAA8C,EAAE,MAAM,iGAAiG,CAAC;AAEjK,OAAO,EAAE,sCAAsC,EAAE,MAAM,sGAAsG,CAAC;AAC9J,OAAO,EAAE,iCAAiC,EAAE,MAAM,iGAAiG,CAAC;AACpJ,OAAO,EAAE,8BAA8B,EAAE,sCAAsC,EAAE,MAAM,8FAA8F,CAAC;AACtL,OAAO,EAAE,4BAA4B,EAAE,MAAM,mFAAmF,CAAC;AACjI,OAAO,EAAE,+BAA+B,EAAE,MAAM,uFAAuF,CAAC;AACxI,OAAO,EAAE,sCAAsC,EAAE,MAAM,gFAAgF,CAAC;AACxI,OAAO,EAAE,qBAAqB,EAAE,MAAM,wFAAwF,CAAC;AAC/H,OAAO,EAAE,8BAA8B,EAAE,MAAM,uGAAuG,CAAC;AACvJ,OAAO,EAAE,mCAAmC,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAClK,OAAO,EAAE,8BAA8B,EAA6C,MAAM,8EAA8E,CAAC;AAGzK,OAAO,EAAE,uBAAuB,EAAkC,MAAM,+EAA+E,CAAC;AAGxJ,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,wEAAwE,CAAC;AACrL,OAAO,EAAE,qCAAqC,EAAE,MAAM,6EAA6E,CAAC;AAGpI,OAAO,EAAE,wCAAwC,EAAE,MAAM,0EAA0E,CAAC;AACpI,OAAO,EAAE,iDAAiD,EAAE,MAAM,yFAAyF,CAAC;AAC5J,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,8FAA8F,CAAC;AAC7I,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AACnJ,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,mCAAmC,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,MAAM,sGAAsG,CAAC;AACvO,OAAO,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACrJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,6EAA6E,CAAC;AAEzH,sGAAsG;AACtG,2FAA2F;AAC3F,qEAAqE;AACrE,OAAO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,iCAAiC,EACjC,gCAAgC,EAChC,8CAA8C,EAC9C,iCAAiC,EACjC,qBAAqB,EACrB,gCAAgC,EAChC,qCAAqC,EACrC,gDAAgD,EAChD,uCAAuC,EACvC,wCAAwC,EACxC,6CAA6C,EAC7C,8CAA8C,EAC9C,mDAAmD,EACnD,+BAA+B,EAC/B,iCAAiC,EACjC,4BAA4B,EAC5B,mCAAmC,EACnC,oDAAoD,EACpD,mDAAmD,EACnD,kCAAkC,EAClC,kCAAkC,EAClC,sCAAsC,EACtC,yCAAyC,EACzC,8CAA8C,EAC9C,4BAA4B,EAC5B,kCAAkC,EAClC,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,mCAAmC,EACnC,4BAA4B,EAC5B,6BAA6B,EAC7B,8BAA8B,EAC9B,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,EAC/B,6BAA6B,EAC7B,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,6BAA6B,GAC9B,MAAM,gFAAgF,CAAC;AACxF,OAAO,EAAE,iCAAiC,EAAE,MAAM,+EAA+E,CAAC;AAClI,OAAO,EAAE,4BAA4B,EAAE,MAAM,0EAA0E,CAAC;AAGxH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAmB,MAAM,uDAAuD,CAAC;AAC5G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,gCAAgC,EAAE,MAAM,gFAAgF,CAAC;AAGlI,OAAO,EAAE,yCAAyC,EAAE,MAAM,0FAA0F,CAAC;AACrJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,mEAAmE,CAAC;AACzH,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAInG,OAAO,EACH,iCAAiC,EACjC,8BAA8B,GACjC,MAAM,wFAAwF,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,mFAAmF,CAAC;AAE9H,OAAO,EAAE,oCAAoC,EAAE,MAAM,4FAA4F,CAAC;AAElJ,OAAO,EAAE,sCAAsC,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,wFAAwF,CAAC;AAEnQ,OAAO,EAAE,qDAAqD,EAAE,MAAM,uHAAuH,CAAC;AAC9L,OAAO,EAAE,6CAA6C,EAAE,MAAM,+GAA+G,CAAC;AAC9K,OAAO,EAAE,sCAAsC,EAAsD,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAG/K,OAAO,EAAE,qBAAqB,EAAE,MAAM,sFAAsF,CAAC;AAC7H,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AACzJ,OAAO,EAAE,uCAAuC,EAAE,MAAM,2FAA2F,CAAC;AACpJ,OAAO,EAAE,qCAAqC,EAAE,MAAM,sFAAsF,CAAC;AAC7I,OAAO,EAAE,mCAAmC,EAAE,MAAM,iFAAiF,CAAC;AAItI,OAAO,EAAE,2BAA2B,EAAE,MAAM,mEAAmE,CAAC;AAChH,OAAO,EAAE,sCAAsC,EAAE,MAAM,iFAAiF,CAAC;AACzI,OAAO,EAAE,8BAA8B,EAAE,MAAM,6EAA6E,CAAC;AAC7H,OAAO,EAAE,gCAAgC,EAAE,MAAM,+EAA+E,CAAC;AAGjI,OAAO,EAAE,mCAAmC,EAAE,MAAM,yFAAyF,CAAC;AAG9I,OAAO,EAAE,yCAAyC,EAAE,MAAM,uFAAuF,CAAC;AAClJ,OAAO,EAAE,kCAAkC,EAAE,MAAM,kFAAkF,CAAC;AAgQtI;;;;;;;;;;;;;;GAcG;AAEH,wHAAwH;AACxH;;;;;;;;;;;;;;;GAeG;AACH,IAAK,sCAmCJ;AAnCD,WAAK,sCAAsC;IACvC,oEAAoE;IACpE,mFAAyC,CAAA;IACzC;;;;;;;;;;;;;OAaG;IACH,iHAAuE,CAAA;IACvE,gFAAgF;IAChF,iFAAuC,CAAA;IACvC,4EAA4E;IAC5E,2EAAiC,CAAA;IACjC;;;;;;;;;OASG;IACH,mGAAyD,CAAA;IACzD,2EAA2E;IAC3E,+EAAqC,CAAA;AACzC,CAAC,EAnCI,sCAAsC,KAAtC,sCAAsC,QAmC1C;AAoBD;;;;;;;;;;GAUG;AACH,SAAS,wCAAwC,CAC7C,MAA8C,EAC9C,aAAmC,EACnC,MAAe;IAEf,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,IAAI,SAAS,CAAC;IAC3D,MAAM,MAAM,GAAG,yEAAyE,CAAC;IACzF,MAAM,WAAW,GAAG,iEAAiE,CAAC;IAEtF,QAAQ,MAAM,EAAE,CAAC;QACb,KAAK,sCAAsC,CAAC,kBAAkB;YAC1D,OAAO,GAAG,MAAM,iEAAiE;kBAC3E,sEAAsE,WAAW,EAAE,CAAC;QAE9F,KAAK,sCAAsC,CAAC,iCAAiC;YACzE,OAAO,GAAG,MAAM,iBAAiB,WAAW,6CAA6C;kBACnF,mFAAmF;kBACnF,0EAA0E,WAAW,IAAI;kBACzF,4FAA4F;kBAC5F,qEAAqE;kBACrE,uFAAuF;kBACvF,wFAAwF;kBACxF,0FAA0F;kBAC1F,GAAG,WAAW,EAAE,CAAC;QAE3B,KAAK,sCAAsC,CAAC,iBAAiB;YACzD,OAAO,GAAG,MAAM,iBAAiB,WAAW,kDAAkD;kBACxF,sFAAsF;kBACtF,0BAA0B,WAAW,EAAE,CAAC;QAElD,KAAK,sCAAsC,CAAC,cAAc;YACtD,OAAO,GAAG,MAAM,iBAAiB,WAAW,4BAA4B;kBAClE,aAAa,MAAM,IAAI,SAAS,qDAAqD;kBACrF,mFAAmF,WAAW,EAAE,CAAC;QAE3G,KAAK,sCAAsC,CAAC,0BAA0B;YAClE,OAAO,GAAG,MAAM,iBAAiB,WAAW,oDAAoD;kBAC1F,2BAA2B,MAAM,IAAI,SAAS,6CAA6C;kBAC3F,+BAA+B,+BAA+B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK;kBAC1F,2FAA2F;kBAC3F,wFAAwF;kBACxF,mDAAmD;kBACnD,2DAA2D,WAAW,EAAE,CAAC;QAEnF,KAAK,sCAAsC,CAAC,gBAAgB;YACxD,OAAO,GAAG,MAAM,iBAAiB,WAAW,yBAAyB;kBAC/D,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,wDAAwD;kBACtF,WAAW,WAAW,EAAE,CAAC;QAEnC,OAAO,CAAC,CAAC,CAAC;YACN,8DAA8D;YAC9D,gEAAgE;YAChE,oBAAoB;YACpB,MAAM,WAAW,GAAU,MAAM,CAAC;YAClC,OAAO,GAAG,MAAM,iBAAiB,WAAW,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,WAAW,EAAE,CAAC;QAC7F,CAAC;IACL,CAAC;AACL,CAAC;AAGM,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAamB;IACU;IACwB;IACjB;IACW;IACb;IACY;IAChB;IACE;IACA;IACE;IACS;IACO;IACe;IACtC;IACF;IACD;IACmB;IACE;IACA;IACL;IACD;IACA;IACG;IACX;IACQ;IACK;IACF;IACX;IACE;IACI;IACH;IACH;IACD;IAKD;IACE;IACQ;IAIG;IAWF;IAKC;IAMzD;IAMA;IAKF;IAIuE;IA7F5F;;;;OAIG;IACK,sBAAsB,GAA8B,yBAAyB,CAAC,mBAAmB,CAAC;IAEhG,QAAQ,CAA+D;IACvE,aAAa,GAAG,KAAK,CAAC;IACxB,cAAc,GAAG,KAAK,CAAC;IAE/B,YAC0D,MAAqB,EACX,gBAAyC,EACjB,iCAA2E,EAC5F,wBAAyD,EAC9C,2BAAsE,EACnF,uBAA8D,EAClD,0BAAoE,EACpF,iBAA2C,EACzC,YAAwC,EACxC,YAAiC,EAC/B,qBAAmD,EAC1C,eAAuD,EAChD,qCAA4E,EAC7D,kBAA+E,EACrH,cAA8B,EAChC,YAA0B,EAC3B,WAA+B,EACZ,8BAAqE,EACnE,gCAAyE,EACzE,gCAAyE,EAC9E,2BAAsE,EACvE,0BAAoE,EACpE,0BAAoE,EACjE,6BAA0E,EACrF,kBAAoD,EAC5C,0BAAsD,EACjD,+BAA8E,EAChF,sBAA4D,EACvE,kBAA6C,EAC3C,oBAAiD,EAC7C,wBAAgE,EACnE,4BAAiE,EACpE,yBAA2D,EAC5D,iBAAkD,EAKnD,uBAAuD,EACrD,yBAA2D,EACnD,0BAA6D,EAI1D,oCAAiF,EAWnF,2BAAyD,EAKxD,gBAA0C,EAMnG,2BAAuE,EAMvE,oCAAyF,EAK3F,uBAA+D,EAIQ,kCAA8E;QAjFhH,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACjB,sCAAiC,GAAjC,iCAAiC,CAA0C;QAC5F,6BAAwB,GAAxB,wBAAwB,CAAiC;QAC9C,gCAA2B,GAA3B,2BAA2B,CAA2C;QACnF,4BAAuB,GAAvB,uBAAuB,CAAuC;QAClD,+BAA0B,GAA1B,0BAA0B,CAA0C;QACpF,sBAAiB,GAAjB,iBAAiB,CAA0B;QACzC,iBAAY,GAAZ,YAAY,CAA4B;QACxC,iBAAY,GAAZ,YAAY,CAAqB;QAC/B,0BAAqB,GAArB,qBAAqB,CAA8B;QAC1C,oBAAe,GAAf,eAAe,CAAwC;QAChD,0CAAqC,GAArC,qCAAqC,CAAuC;QAC7D,uBAAkB,GAAlB,kBAAkB,CAA6D;QACrH,mBAAc,GAAd,cAAc,CAAgB;QAChC,iBAAY,GAAZ,YAAY,CAAc;QAC3B,gBAAW,GAAX,WAAW,CAAoB;QACZ,mCAA8B,GAA9B,8BAA8B,CAAuC;QACnE,qCAAgC,GAAhC,gCAAgC,CAAyC;QACzE,qCAAgC,GAAhC,gCAAgC,CAAyC;QAC9E,gCAA2B,GAA3B,2BAA2B,CAA2C;QACvE,+BAA0B,GAA1B,0BAA0B,CAA0C;QACpE,+BAA0B,GAA1B,0BAA0B,CAA0C;QACjE,kCAA6B,GAA7B,6BAA6B,CAA6C;QACrF,uBAAkB,GAAlB,kBAAkB,CAAkC;QAC5C,+BAA0B,GAA1B,0BAA0B,CAA4B;QACjD,oCAA+B,GAA/B,+BAA+B,CAA+C;QAChF,2BAAsB,GAAtB,sBAAsB,CAAsC;QACvE,uBAAkB,GAAlB,kBAAkB,CAA2B;QAC3C,yBAAoB,GAApB,oBAAoB,CAA6B;QAC7C,6BAAwB,GAAxB,wBAAwB,CAAwC;QACnE,iCAA4B,GAA5B,4BAA4B,CAAqC;QACpE,8BAAyB,GAAzB,yBAAyB,CAAkC;QAC5D,sBAAiB,GAAjB,iBAAiB,CAAiC;QAKnD,4BAAuB,GAAvB,uBAAuB,CAAgC;QACrD,8BAAyB,GAAzB,yBAAyB,CAAkC;QACnD,+BAA0B,GAA1B,0BAA0B,CAAmC;QAI1D,yCAAoC,GAApC,oCAAoC,CAA6C;QAWnF,gCAA2B,GAA3B,2BAA2B,CAA8B;QAKxD,qBAAgB,GAAhB,gBAAgB,CAA0B;QAMnG,gCAA2B,GAA3B,2BAA2B,CAA4C;QAMvE,yCAAoC,GAApC,oCAAoC,CAAqD;QAK3F,4BAAuB,GAAvB,uBAAuB,CAAwC;QAIQ,uCAAkC,GAAlC,kCAAkC,CAA4C;QAEtK,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,wBAAwB,GAAG,wBAAwB,CAAC;QACzD,IAAI,CAAC,2BAA2B,GAAG,2BAA2B,CAAC;QAC/D,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;QACvD,IAAI,CAAC,0BAA0B,GAAG,0BAA0B,CAAC;QAC7D,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QAEnD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAEzE,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU,CAAC,MAAuC;QAE3D,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,OAAO;QACX,CAAC;QAED,MAAM,EACF,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,6BAA6B,EAC7B,+BAA+B,EAC/B,4BAA4B,GAAG,EAAE,EACjC,4BAA4B,EAC5B,yBAAyB,EACzB,qCAAqC,EACrC,uBAAuB,EACvB,4BAA4B,EAC5B,WAAW,EACX,iBAAiB,EACjB,SAAS,EACT,mBAAmB,EACnB,qBAAqB,GAAG,KAAK,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,4BAA4B,EAC5B,aAAa,EACb,uBAAuB,EACvB,SAAS,EACT,sBAAsB,EACtB,eAAe,GAAG,EAAE,EACpB,cAAc,GAAG,yBAAyB,CAAC,mBAAmB,EAC9D,YAAY,GAAG,KAAK,EACpB,YAAY,GAAG,KAAK,EACpB,gBAAgB,GAAG,KAAK,EACxB,gCAAgC,EAChC,iCAAiC,GACpC,GAAG,MAAM,CAAC;QAEX,qEAAqE;QACrE,sEAAsE;QACtE,yCAAyC;QACzC,MAAM,cAAc,GAAG,8CAA8C,CAAC,cAAc,CAAC,CAAC;QACtF;;;;WAIG;QACH,IAAI,CAAC,sBAAsB,GAAG,cAAc,CAAC;QAE7C,IAAI,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;YACnE,+CAA+C;YAC/C,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAE9D,mDAAmD;YACnD,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,qBAAqB,CAAC;YAE9C,IAAG,CAAC,qBAAqB,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;gBACzC,IAAI,eAAe,EAAE,CAAC;oBAClB,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;gBAChE,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;gBAC9D,IAAI,aAAa,EAAE,CAAC;oBAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;wBACvC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;qBACvC,CAAC,CAAC;gBACP,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,+BAA+B,EAAE,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;gBAEtE;;;;;;;;;;;;;mBAaG;gBACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;gBACjG,IAAI,kBAAkB,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,+BAA+B,kBAAkB,CAAC,UAAU,uBAAuB;0BACjF,gBAAgB,kBAAkB,CAAC,cAAc,mDAAmD;0BACpG,YAAY,kBAAkB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;0BAC1D,2EAA2E,EAC7E,EAAE,cAAc,EAAE,kBAAkB,CAAC,cAAc,EAAE,UAAU,EAAE,kBAAkB,CAAC,UAAU,EAAE,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,CAClJ,CAAC;gBACN,CAAC;gBACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA+BG;gBACH,IAAI,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChE,IAAI,CAAC;wBACD,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;wBACpC,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;oBAC9D,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAQ,CAAC,CAAC;wBACnE,MAAM,CAAC,CAAC;oBACZ,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,QAAQ,CAAC,iFAAiF,CAAC,CAAC;gBACrG,CAAC;gBACD,uEAAuE;gBACvE,oEAAoE;gBACpE,IAAI,CAAC;oBACD,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;oBAClC,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACT,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,GAAG,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrH,CAAC;gBAED,6EAA6E;gBAC7E,IAAI,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,EAAE,CAAC;oBACxC,IAAI,CAAC;wBACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;wBAC1C,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;oBAChD,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACT,8EAA8E;wBAC9E,8EAA8E;wBAC9E,0EAA0E;wBAC1E,0CAA0C;wBAC1C,EAAE;wBACF,2EAA2E;wBAC3E,0EAA0E;wBAC1E,6EAA6E;wBAC7E,6EAA6E;wBAC7E,2EAA2E;wBAC3E,6EAA6E;wBAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uFAAuF,EAAE,EAAE,GAAG,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACrJ,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,QAAQ,CAAC,yDAAyD,CAAC,CAAC;gBAC7E,CAAC;YACL,CAAC;YAED,8DAA8D;YAC9D,iEAAiE;YACjE,6DAA6D;YAC7D,gEAAgE;YAChE,MAAM,iBAAiB,GAAG,kCAAkC,CAAC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;YAE3G,IAAI,iBAAiB,EAAE,CAAC;gBACpB,mFAAmF;gBACnF,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,oBAAoB,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YAChH,CAAC;YAED;;;;;;;;;;;;eAYG;YACH;;;;;;;;;;;;;;eAcG;YACH,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,sBAAsB,KAAK,yBAAyB,CAAC,mBAAmB,EAAE,CAAC;gBAChH;;;;;;;;;;;;;;mBAcG;gBACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;gBAC9E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,EAAE,0BAA0B,KAAK,SAAS,EAAE,CAAC;oBAC1F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACL,IAAI,EAAE,uBAAuB,CAAC,2BAA2B;4BACzD,OAAO,EAAE,eAAe;4BACxB,OAAO,EAAE,gDAAgD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;kCACnG,kGAAkG;kCAClG,qGAAqG;kCACrG,sEAAsE;yBAC/E;qBACJ,CAAC,CAAC;gBACP,CAAC;gBACD,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CACzC,iBAAiB,EAAE,eAAe,EAClC,iCAAiC,CAAC;oBAC9B,YAAY,EAAE,eAAe,EAAE,0BAA0B;iBAC5D,CAAC,EACF,SAAS,EACT,SAAS;gBACT;;;;mBAIG;gBACH,uCAAuC,CAAC;oBACpC,YAAY,EAAE,eAAe,EAAE,0BAA0B;iBAC5D,CAAC,CACL,CAAC;YACN,CAAC;YAED,2CAA2C;YAC3C,IAAI,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;YACxD,IAAI,WAAW,EAAE,CAAC;gBACd,IAAI,CAAC,qBAAqB,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;gBAClE,IAAI,CAAC,QAAQ,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACJ,iEAAiE;gBACjE,IAAI,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YAED,4FAA4F;YAC5F,gGAAgG;YAChG,0FAA0F;YAC1F,+EAA+E;YAC/E,MAAM,yBAAyB,GAAG,2CAA2C,CAAC;gBAC1E,iBAAiB,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAU;gBAChI,wBAAwB,EAAE,cAAc,CAAC,SAAS;gBAClD,yBAAyB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,oBAAoB,CAAC,aAAa,CAAC;aACtI,CAAC,CAAC;YACH,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACL,MAAM,EAAE,wCAAwC;wBAChD,UAAU,EAAE,yBAAyB;wBACrC,OAAO,EAAE,oGAAoG;8BACvG,sGAAsG;8BACtG,wEAAwE;8BACxE,qCAAqC;qBAC9C;iBACJ,CAAC,CAAC;YACP,CAAC;YAED,0GAA0G;YAC1G,+GAA+G;YAC/G,oGAAoG;YACpG,CAAC;gBACG,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBACnI,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;gBAChH,MAAM,4BAA4B,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAC5G,4CAA4C,CACvC,UAAiH,EAAE,uBAAuB,EAAE,uBAAuB,EACpK,EAAE,gBAAgB,EAAE,CACvB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,gBAAgB,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;gBACvD,IAAI,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACL,MAAM,EAAE,oDAAoD;4BAC5D,MAAM,EAAE,4BAA4B;4BACpC,OAAO,EAAE,kHAAkH;kCACrH,6DAA6D;yBACtE;qBACJ,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAED,6GAA6G;YAC7G,6GAA6G;YAC7G,uGAAuG;YACvG,MAAM,wBAAwB,GAAG,wCAAwC,CAAC;gBACtE,yBAAyB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,oBAAoB,CAAC,aAAa,CAAC;gBACnI,yBAAyB,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;gBAC/E,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;aACjF,CAAC,CAAC;YACH,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACL,MAAM,EAAE,qCAAqC;wBAC7C,UAAU,EAAE,wBAAwB;wBACpC,OAAO,EAAE,4GAA4G;8BAC/G,+GAA+G;8BAC/G,yDAAyD;qBAClE;iBACJ,CAAC,CAAC;YACP,CAAC;YAED;;;;;;;;;eASG;YACH,IAAI,CAAC,wBAAwB,CAAC,wBAAwB,CAClD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,KAAK,CAAC,CACrF,CAAC;YAEF,2DAA2D;YAC3D,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YAEvD,sFAAsF;YACtF,gEAAgE;YAChE,MAAM,eAAe,GAAgC,iBAAiB,EAAE,SAAS,CAAC;YAElF,8DAA8D;YAC9D,wEAAwE;YACxE,yEAAyE;YACzE,0EAA0E;YAC1E,4EAA4E;YAC5E,MAAM,qBAAqB,GAAG,yCAAyC,CACnE,iBAAiB,EACjB,EAAE,qBAAqB,EAAE,CAC5B,CAAC;YAEF,IAAI,qBAAqB,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,qCAAqC,qBAAqB,CAAC,IAAI,QAAQ,EAAE;oBACnF,eAAe,EAAE,CAAC,iBAAiB,EAAE,OAAO,EAAE,OAAO;oBACrD,qBAAqB,EAAE,CAAC,GAAG,EAAE;wBACzB,MAAM,aAAa,GAAG,iBAAiB,EAAE,OAAO,CAAC;wBACjD,IAAI,CAAC,aAAa,EAAE,OAAO;4BAAE,OAAO,KAAK,CAAC;wBAC1C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,aAAa,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;wBACtE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1D,CAAC,CAAC,EAAE;oBACJ,iBAAiB,EAAE,CAAC,eAAe,EAAE,OAAO;iBAC/C,CAAC,CAAC;YACP,CAAC;YAED,MAAM,IAAI,CAAC,wBAAwB,CAAC,UAAU,CACtC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,CAAC,6BAA6B,IAAI,EAAE,CAAmD,EACvF,+BAA+B,EAC/B,4BAA4B,EAC5B,4BAA4B,EAC5B,SAAS,EAAE,8CAA8C;YACzD,qBAAqB,EACrB,yBAAyB,EACzB,qCAAqC,CAC5C,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YAC/D,IAAI,iBAAiB,IAAI,iCAAiC,EAAE,CAAC;gBACzD,MAAM,iCAAiC,CAAC;oBACpC,SAAS,EAAE,iBAAiB;oBAC5B,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;oBACvD,YAAY,EAAE,IAAI,CAAC,YAAY;iBAClC,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,EAAE;gBACjE,kBAAkB,EAAE,cAAc,CAAC,sCAAsC;aAC5E,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;YAClE,IAAI,CAAC,kCAAkC,EAAE,UAAU,CAAC,4BAA4B,IAAI,EAAE,EAAE;gBACpF,kBAAkB,EAAE,cAAc,CAAC,sCAAsC;aAC5E,CAAC,CAAC;YAEH,qDAAqD;YACrD,IAAI,CAAC,QAAQ,CAAC,iDAAiD,CAAC,CAAC;YACjE,IAAI,CAAC,gCAAgC,CAAC,oBAAoB,EAAE,CAAC;YAC7D,IAAI,wBAAwB,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,gCAAgC,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,CAAC,gCAAgC,CAAC,mBAAmB,EAAE,CAAC;YAC5D,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,EAAE,CAAC;YAE1D,oEAAoE;YACpE,IAAI,0BAA0B,EAAE,CAAC;gBAC7B,MAAM,cAAc,GAAG,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,EAAE,CAAC;gBACjF,IAAI,CAAC,gCAAgC,CAAC,gBAAgB,CAAC;oBACnD,WAAW,EAAE,cAAc;oBAC3B,QAAQ,EAAE,0BAA0B,CAAC,QAAQ,IAAI,EAAE;oBACnD,cAAc,EAAE,0BAA0B,CAAC,cAAc;oBACzD,oBAAoB,EAAE;wBAClB,eAAe,EAAE,0BAA0B,CAAC,oBAAoB,EAAE,eAAe,IAAI,6BAA6B,CAAC,cAAc;wBACjI,mBAAmB,EAAE,0BAA0B,CAAC,oBAAoB,EAAE,mBAAmB,IAAI,6BAA6B,CAAC,IAAI;wBAC/H,YAAY,EAAE,0BAA0B,CAAC,oBAAoB,EAAE,YAAY,IAAI,EAAE;wBACjF,cAAc,EAAE,0BAA0B,CAAC,oBAAoB,EAAE,cAAc,IAAI;4BAC/E,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE,6BAA6B,CAAC,cAAc;4BAC/F,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,6BAA6B,CAAC,oBAAoB;4BAChG,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,6BAA6B,CAAC,IAAI;yBACnF;qBACJ;iBACJ,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,gEAAgE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,SAAS,EAAE,YAAY,CAAC;YAEzE,IAAI,CAAC,gCAAgC,CAAC,0BAA0B,EAAE,CAAC;YACnE,IAAI,CAAC,gCAAgC,CAAC,4BAA4B,CAAC;gBAC/D,eAAe,EAAE,0BAA0B,EAAE,QAAQ;gBACrD,gBAAgB;gBAChB,uBAAuB;gBACvB,kBAAkB;gBAClB,qBAAqB;gBACrB,eAAe,EAAE,CAAC,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC;aAClI,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YAExE,uDAAuD;YACvD,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;YAClE,IAAI,yBAAyB,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpE,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,yBAAyB,EAAE,CAAC;oBAClD,IAAI,CAAC,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,cAAc,yBAAyB,CAAC,MAAM,gCAAgC,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,0BAA0B,IAAI,0BAA0B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtE,IAAI,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;gBACtF,IAAI,CAAC,2BAA2B,CAAC,mBAAmB,EAAE,CAAC;gBACvD,IAAI,CAAC,2BAA2B,CAAC,iBAAiB,EAAE,CAAC;YACzD,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,0DAA0D,CAAC,CAAC;YAE1E;;;;;;;;;;eAUG;YACH,IAAI,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxD,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,mBAAmB,EAAE,CAAC;oBAC5C,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,cAAc,mBAAmB,CAAC,MAAM,0BAA0B,CAAC,CAAC;YACtF,CAAC;YACD,IAAI,qBAAqB,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;gBAC9E,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,EAAE,CAAC;gBACzD,IAAI,CAAC,6BAA6B,CAAC,iBAAiB,EAAE,CAAC;YAC3D,CAAC;YAED,2DAA2D;YAC3D;;;;;eAKG;YACH,IAAI,CAAC,qBAAqB,IAAI,eAAe,EAAE,OAAO,IAAI,cAAc,CAAC,yBAAyB,EAAE,CAAC;gBACjG,IAAI,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;gBACxD,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;gBAE5D,mEAAmE;gBACnE,wCAAwC,CAAC,IAAI,CAAC,kBAAkB,EAAE,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBAEtG,uDAAuD;gBACvD,IAAI,eAAe,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC;oBAC/C,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC;wBAClE;;;;;;;2BAOG;wBACH,MAAM,YAAY,GAAG,SAAS,CAAC,aAAa,KAAK,uBAAuB,CAAC,SAAS;4BAC9E,CAAC,CAAC,SAAS,CAAC,YAAY;4BACxB,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC;wBAChC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;4BACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,uCAAuC,YAAY,gDAAgD;kCAC7F,oDAAoD,CAC7D,CAAC;wBACN,CAAC;wBACD,IAAI,SAAS,CAAC,aAAa,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;4BAChE;;;;;;+BAMG;4BACH,IAAI,CAAC,cAAc,CAAC,+CAA+C,EAAE,CAAC;gCAClE,IAAI,CAAC,QAAQ,CACT,mCAAmC,SAAS,CAAC,YAAY,kBAAkB;sCACrE,oBAAoB,cAAc,oCAAoC,CAC/E,CAAC;4BACN,CAAC;iCAAM,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;gCACjF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,SAAS,CAAC,YAAY,GAAG,CAAC,CAAC;4BACjH,CAAC;wBACL,CAAC;6BAAM,IAAI,SAAS,CAAC,aAAa,KAAK,uBAAuB,CAAC,kBAAkB,EAAE,CAAC;4BAChF,IAAI,CAAC,QAAQ,CAAC,6DAA6D,SAAS,CAAC,eAAe,0BAA0B,CAAC,CAAC;wBACpI,CAAC;oBACL,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE;oBAC9C,qBAAqB,EAAE,eAAe,CAAC,qBAAqB;oBAC5D,uBAAuB,EAAE,eAAe,CAAC,uBAAuB;oBAChE,oBAAoB,EAAE,eAAe,CAAC,oBAAoB;oBAC1D,uBAAuB,EAAE,eAAe,CAAC,kBAAkB,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;iBACrF,CAAC,CAAC;YACP,CAAC;iBAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,4EAA4E,CAAC,CAAC;YAChG,CAAC;YAED,8EAA8E;YAC9E,EAAE;YACF,sEAAsE;YACtE,6EAA6E;YAC7E,gFAAgF;YAChF,+EAA+E;YAC/E,+EAA+E;YAC/E,EAAE;YACF,kFAAkF;YAClF,mFAAmF;YACnF,gFAAgF;YAChF,iDAAiD;YACjD,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;YACjD,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC;gBAC3D,eAAe;gBACf,mBAAmB,EAAE,uBAAuB;aAC/C,CAAC,CAAC;YACH,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAC1C,iBAAiB,CAAC,QAAQ,EAC1B,eAAe,EACf,iBAAiB,CAAC,UAAU,CAC/B,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE;gBACrD,sBAAsB,EAAE,OAAO,CAAC,eAAe,CAAC;gBAChD,aAAa,EAAE,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI;aAChF,CAAC,CAAC;YAEH,oDAAoD;YACpD,8FAA8F;YAC9F,IAAI,iBAAiB,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAAC;gBAChE,MAAM,IAAI,CAAC,gCAAgC,CAAC,UAAU,EAAE,CAAC;gBACzD,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;gBAExE,qFAAqF;gBACrF,oFAAoF;gBACpF,8EAA8E;gBAC9E,gFAAgF;gBAChF,kFAAkF;gBAClF,yBAAyB;gBACzB,IAAI,CAAC,gCAAgC,CAAC,6BAA6B,CAAC;oBAChE,kBAAkB,EAAE,cAAc,CAAC,oCAAoC;iBAC1E,CAAC,CAAC;gBAEH,yEAAyE;gBACzE,6EAA6E;gBAC7E,6EAA6E;gBAC7E,yEAAyE;gBACzE,2EAA2E;gBAC3E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,yDAAyD;gBACzD,EAAE;gBACF,4EAA4E;gBAC5E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,4EAA4E;gBAC5E,8EAA8E;gBAC9E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,8EAA8E;gBAC9E,4EAA4E;gBAC5E,MAAM,yBAAyB,GAAG,IAAI,CAAC,gCAAgC,CAAC,oCAAoC,CACxG,gBAAgB,CAAC,sBAAsB,CAC1C,CAAC;gBACF,MAAM,oBAAoB,GAAG;oBACzB,yCAAyC,EAAE,cAAc,CAAC,kCAAkC;oBAC5F,2BAA2B,EAAE,IAAI,CAAC,gCAAgC,CAAC,yBAAyB,CACxF,gBAAgB,CAAC,sBAAsB,CAC1C;oBACD,6BAA6B,EAAE,yBAAyB,CAAC,MAAM;iBAClE,CAAC;gBACF,yFAAyF;gBACzF,0FAA0F;gBAC1F,kDAAkD;gBAClD,IAAI,mCAAmC,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,yBAAyB,EAAE,CAAC,GAAG,yBAAyB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChI,CAAC;gBACD,IAAI,qCAAqC,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,0FAA0F;0BACxF,8FAA8F;0BAC9F,+FAA+F,CACpG,CAAC;gBACN,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,+GAA+G,CAAC,CAAC;YACnI,CAAC;YAED,6CAA6C;YAC7C,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;YAC1D,MAAM,gCAAgC,GAAG;gBACrC,GAAG,CAAC,mBAAmB,EAAE,0BAA0B,IAAI,EAAE,CAAC;aAC7D,CAAC;YACF,MAAM,YAAY,GAAG;gBACjB,GAAG,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE,CAAC;aACzC,CAAC;YACF,MAAM,mBAAmB,GAAG;gBACxB,GAAG,CAAC,mBAAmB,EAAE,aAAa,IAAI,EAAE,CAAC;aAChD,CAAC;YACF,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAC5C,gCAAgC,EAChC,YAAY,EACZ,mBAAmB,EACnB,SAAS,EACT,mBAAmB,EAAE,gBAAgB,IAAI,EAAE,CAC9C,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;YAElE,uFAAuF;YACvF,2FAA2F;YAC3F,2FAA2F;YAC3F,2FAA2F;YAC3F,wFAAwF;YACxF,yFAAyF;YACzF,mCAAmC;YACnC,+EAA+E;YAC/E,mFAAmF;YACnF,gFAAgF;YAChF,mFAAmF;YACnF,mFAAmF;YACnF,6EAA6E;YAC7E,gFAAgF;YAChF,uCAAuC;YACvC,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;YACtE,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;YACzE,IAAI,cAAc,CAAC,2CAA2C,EAAE,CAAC;gBAC7D,IAAI,CAAC,+BAA+B,CAAC,0BAA0B,CAC3D,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EACvE,IAAI,CAAC,0BAA0B;qBAC1B,SAAS,EAAE;qBACX,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,0BAA0B,CAAC,QAAQ,CAAC;qBAC7E,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CACnC,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,6DAA6D,CAAC,CAAC;YACjF,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,sGAAsG,EAAE;oBAClH,cAAc;iBACjB,CAAC,CAAC;YACP,CAAC;YAED,uDAAuD;YACvD,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;YACjD,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,EAAE;gBAC5C,oBAAoB,EAAE,qBAAqB;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;YAEzD,gDAAgD;YAChD,IAAI,wBAAwB,IAAI,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/E,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;YAC3E,CAAC;YAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACzB,+EAA+E;gBAC/E,gFAAgF;gBAChF,mFAAmF;gBACnF,qFAAqF;gBACrF,kFAAkF;gBAClF,IAAI,CAAC,2BAA2B,EAAE,UAAU,EAAE,CAAC;YACnD,CAAC;YAED,uCAAuC;YACvC,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzF,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;oBACtC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBACtD,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;YACrG,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YAED,gDAAgD;YAChD,IAAI,uBAAuB,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,uBAAuB,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC;gBACvE,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,uBAAuB,CAAC,MAAM,EAAE,CAAC,CAAC;YACpH,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,0EAA0E,CAAC,CAAC;YAC9F,CAAC;YAED,iCAAiC;YACjC,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YAC/D,IAAI,CAAC,wBAAwB,CAAC,yBAAyB,EAAE,CAAC;YAE1D,2CAA2C;YAC3C,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,MAAM,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,EAAE,CAAC;YAE/E,2EAA2E;YAC3E,sEAAsE;YACtE,kEAAkE;YAClE,6EAA6E;YAC7E,iDAAiD;YACjD,EAAE;YACF,6EAA6E;YAC7E,+EAA+E;YAC/E,6EAA6E;YAC7E,6EAA6E;YAC7E,2EAA2E;YAC3E,+BAA+B;YAC/B,IAAI,uBAAuB,GAAqC,EAAE,CAAC;YACnE,IAAI,CAAC;gBACD,uBAAuB,GAAG,qCAAqC,CAC3D,iBAAiB,CAAC,sBAA6B,CAClD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0EAA0E,EAAE;oBACzF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACxC,CAAC,CAAC;YACP,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,uBAAuB,EAAE,CAAC;gBAC9C,IAAI,SAAS,CAAC,QAAQ,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;oBACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,SAAS,CAAC,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE;wBAC9G,YAAY,EAAE,SAAS,CAAC,YAAY;wBACpC,eAAe,EAAE,SAAS,CAAC,eAAe;wBAC1C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;wBAChD,IAAI,EAAE,SAAS,CAAC,IAAI;qBACvB,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YACD,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,MAAM,CACxD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,sCAAsC,CAAC,IAAI,CACpF,CAAC;YACF,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACX,kCAAkC,qBAAqB,CAAC,MAAM,8DAA8D;oBAC5H,qBAAqB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9E,CAAC;YACN,CAAC;YAED,+CAA+C;YAC/C,kGAAkG;YAClG,kGAAkG;YAClG,mGAAmG;YACnG,4FAA4F;YAC5F,2FAA2F;YAC3F,2FAA2F;YAC3F,4FAA4F;YAC5F,8FAA8F;YAC9F,IAAI,0BAA0B,GAAqC,EAAE,CAAC;YACtE,IAAI,CAAC;gBACD,0BAA0B,GAAG,2CAA2C,CAAC,iBAAiB,CAAC,sBAA6B,CAAC,CAAC;YAC9H,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,EAAE;oBAC5E,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACxC,CAAC,CAAC;YACP,CAAC;YACD,IAAI,0BAA0B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACX,kCAAkC,0BAA0B,CAAC,MAAM,mFAAmF;oBACtJ,0BAA0B,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACvF,CAAC;YACN,CAAC;YAED,mEAAmE;YACnE,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,sEAAsE;YACtE,0EAA0E;YAC1E,0EAA0E;YAC1E,+CAA+C;YAC/C,mDAAmD;YACnD,IAAI,gCAAgC,GAAsC,EAAE,CAAC;YAC7E,IAAI,CAAC;gBACD,gCAAgC,GAAG,8BAA8B,CAC7D,iBAAiB,CAAC,sBAA6B,CAClD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;oBAChF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACxC,CAAC,CAAC;YACP,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,gCAAgC,EAAE,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,SAAS,CAAC,OAAO,EAAE,EAAE;oBAClE,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;oBAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;oBAChD,aAAa,EAAE,SAAS,CAAC,aAAa;iBACzC,CAAC,CAAC;YACP,CAAC;YACD,IAAI,gCAAgC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CACX,kCAAkC,gCAAgC,CAAC,MAAM,uCAAuC;oBAChH,gDAAgD;oBAChD,gCAAgC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7F,CAAC;YACN,CAAC;YAED,4EAA4E;YAC5E,0FAA0F;YAC1F,kGAAkG;YAClG,6FAA6F;YAC7F,+FAA+F;YAC/F,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,yFAAyF;YACzF,sFAAsF;YACtF,yFAAyF;YACzF,0FAA0F;YAC1F,yBAAyB;YACzB,0FAA0F;YAC1F,wFAAwF;YACxF,oEAAoE;YACpE,IAAI,6BAA6B,GAA8C,EAAE,CAAC;YAClF,IAAI,CAAC;gBACD,6BAA6B,GAAG,sCAAsC,CAClE,iBAAiB,CAAC,sBAA6B,CAClD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0EAA0E,EAAE;oBACzF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACxC,CAAC,CAAC;YACP,CAAC;YACD,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,MAAM,CAC/D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,sBAAsB,CAAC,MAAM,CACtE,CAAC;YACF,MAAM,uBAAuB,GAAG,6BAA6B,CAAC,MAAM,CAChE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,sBAAsB,CAAC,MAAM,CACtE,CAAC;YACF,0FAA0F;YAC1F,qEAAqE;YACrE,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,uFAAuF;gBACvF,sFAAsF;gBACtF,sFAAsF;gBACtF,gFAAgF;gBAChF,8DAA8D;gBAC9D,MAAM,aAAa,GAAG;oBAClB,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;iBACtG,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,yCAAyC,aAAa,CAAC,MAAM,2CAA2C;oBACxG,uGAAuG;oBACvG,qGAAqG;oBACrG,kGAAkG;oBAClG,sGAAsG;oBACtG,sBAAsB,EACtB;oBACI,KAAK,EAAE,aAAa;oBACpB,qFAAqF;oBACrF,uEAAuE;oBACvE,qBAAqB,EAAE,uBAAuB,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM;iBAC/E,CACJ,CAAC;YACN,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,sBAAsB,EAAE,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,SAAS,CAAC,OAAO,EAAE,EAAE;oBAC3E,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;oBAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;oBAChD,QAAQ,EAAE,SAAS,CAAC,QAAQ;iBAC/B,CAAC,CAAC;YACP,CAAC;YACD,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACX,kCAAkC,sBAAsB,CAAC,MAAM,wCAAwC;oBACvG,mHAAmH;oBACnH,sBAAsB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnF,CAAC;YACN,CAAC;YAED,sFAAsF;YACtF,yFAAyF;YACzF,yFAAyF;YACzF,4FAA4F;YAC5F,4FAA4F;YAC5F,yFAAyF;YACzF,iEAAiE;YACjE,EAAE;YACF,6FAA6F;YAC7F,uFAAuF;YACvF,2FAA2F;YAC3F,6FAA6F;YAC7F,2DAA2D;YAC3D,IAAI,0BAA0B,GAAkE,EAAE,CAAC;YACnG,IAAI,CAAC;gBACD,0BAA0B,GAAG,0CAA0C,CACnE,iBAAiB,CAAC,sBAA6B,CAClD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;oBACxF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACxC,CAAC,CAAC;YACP,CAAC;YACD,IAAI,0BAA0B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,yCAAyC,0BAA0B,CAAC,MAAM,mCAAmC;oBAC7G,0GAA0G;oBAC1G,2GAA2G;oBAC3G,0EAA0E;oBAC1E,0GAA0G;oBAC1G,mFAAmF,EACnF;oBACI,KAAK,EAAE,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,GAAG,IAAI,CAAC,iBAAiB,OAAO,IAAI,CAAC,kBAAkB,EAAE;wBACzD,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,WAAW,GAAG,CAAC;iBAC3F,CACJ,CAAC;YACN,CAAC;YAED,kFAAkF;YAClF,6EAA6E;YAC7E,6EAA6E;YAC7E,2EAA2E;YAC3E,+EAA+E;YAC/E,2EAA2E;YAC3E,iFAAiF;YACjF,+EAA+E;YAC/E,+EAA+E;YAC/E,iFAAiF;YACjF,6EAA6E;YAC7E,kFAAkF;YAClF,MAAM,+BAA+B,GAAa,EAAE,CAAC;YACrD,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,CACnC,iBAAiB,CAAC,sBAAsB,CACS,EAAE,CAAC;gBACpD,MAAM,iBAAiB,GAAG,WAAW,CAAC,kBAAkB,CAAC;gBACzD,MAAM,mBAAmB,GAA6B,WAAW,CAAC,qBAAqB,EAAE,mBAAmB,IAAI,EAAE,CAAC;gBACnH,KAAK,MAAM,YAAY,IAAI,mBAAmB,EAAE,CAAC;oBAC7C,IAAI,YAAY,CAAC,MAAM,KAAK,kBAAkB,CAAC,WAAW;wBAAE,SAAS;oBACrE,IAAI,YAAY,CAAC,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,KAAK,IAAI;wBAAE,SAAS;oBACxF,uEAAuE;oBACvE,2EAA2E;oBAC3E,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,iBAAiB,CAAC;wBAAE,SAAS;oBAC5F,IAAI,CAAC;wBACD,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,CACxD,iBAAiB,EACjB,qBAAqB,CAAC,MAAM,CAC/B,CAAC;oBACN,CAAC;oBAAC,MAAM,CAAC;wBACL,+BAA+B,CAAC,IAAI,CAChC,sBAAsB,iBAAiB,cAAc,YAAY,CAAC,aAAa,aAAa;4BAC5F,kGAAkG;4BAClG,kGAAkG;4BAClG,kGAAkG,CACrG,CAAC;oBACN,CAAC;gBACL,CAAC;YACL,CAAC;YACD,IAAI,+BAA+B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CACX,kCAAkC,+BAA+B,CAAC,MAAM,uCAAuC;oBAC/G,uFAAuF;oBACvF,+BAA+B,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAChF,CAAC;YACN,CAAC;YAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAClC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,sBAAsB,CAA2D,CACrH,CAAC;YAEF,IAAI,0BAA0B,KAAK,SAAS,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACrE,MAAM,IAAI,KAAK,CACX,uFAAuF;sBACrF,0FAA0F;sBAC1F,gDAAgD,CACrD,CAAC;YACN,CAAC;YACD,IAAI,0BAA0B,KAAK,SAAS,EAAE,CAAC;gBAC3C,oFAAoF;gBACpF,IAAI,CAAC,2BAA2B,CAAC,wCAAwC,CAAC,0BAA0B,CAAC,CAAC;YAC1G,CAAC;YAED,oEAAoE;YACpE,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,sBAAsB,EAAE,gBAAgB,IAAI,SAAS,CAAC,CAAC;YACrH,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;YAElE,2FAA2F;YAC3F,4FAA4F;YAC5F,wFAAwF;YACxF,kFAAkF;YAClF,6FAA6F;YAC7F,2FAA2F;YAC3F,2FAA2F;YAC3F,yDAAyD;YACzD,uFAAuF;YACvF,0FAA0F;YAC1F,oFAAoF;YACpF,wFAAwF;YACxF,oFAAoF;YACpF,wEAAwE;YACxE,EAAE;YACF,wFAAwF;YACxF,sFAAsF;YACtF,sFAAsF;YACtF,wFAAwF;YACxF,kFAAkF;YAClF,gFAAgF;YAChF,2EAA2E;YAC3E,+DAA+D;YAC/D,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACzB,IAAI,CAAC,QAAQ,CAAC,uDAAuD,CAAC,CAAC;gBACvE,MAAM,IAAI,CAAC,2BAA2B,CAAC,8BAA8B,EAAE,CAAC;gBAExE,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,2BAA2B,CAAC,4BAA4B,EAAE,CAAC;gBACtE,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YAED,6DAA6D;YAC7D,gEAAgE;YAChE,qCAAqC;YACrC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC;gBAC/B,GAAG,2CAA2C;gBAC9C,GAAG,4BAA4B;aAClC,CAAC,CAAC;YAEH,IAAI,iBAAiB,EAAE,CAAC;gBACpB,6DAA6D;gBAC7D,0DAA0D;gBAC1D,yDAAyD;gBACzD,4DAA4D;gBAC5D,IAAI,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAAC;gBAChE,IAAI,CAAC,iCAAiC,CAAC,mCAAmC,CAAC,iBAAiB,CAAC,CAAC;gBAC9F,kFAAkF;gBAClF,mFAAmF;gBACnF,gFAAgF;gBAChF,MAAM,IAAI,CAAC,iCAAiC,CAAC,qCAAqC,EAAE,CAAC;gBACrF,2FAA2F;gBAC3F,6FAA6F;gBAC7F,2FAA2F;gBAC3F,IAAI,cAAc,CAAC,wBAAwB,EAAE,CAAC;oBAC1C,MAAM,uBAAuB,GAAG,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,EAAE;yBAC3E,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC;oBACjG,MAAM,sCAAsC,CAAC;wBACzC,cAAc,EAAE,uBAAgC;wBAChD,iBAAiB,EAAE,uBAAgC;wBACnD,QAAQ,EAAE,iBAAiB,CAAC,UAAU,EAAE,aAAa;wBACrD,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;wBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;qBACtB,CAAC,CAAC;gBACP,CAAC;gBACD,IAAI,cAAc,CAAC,sCAAsC,EAAE,CAAC;oBACxD,MAAM,IAAI,CAAC,iCAAiC;yBACvC,8CAA8C,CAC3C,iBAAiB,CACpB,CAAC;gBACV,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,QAAQ,CACT,oFAAoF;0BAClF,oFAAoF;0BACpF,oFAAoF;0BACpF,kEAAkE,CACvE,CAAC;gBACN,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YAC5E,CAAC;YAED,8DAA8D;YAC9D,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,EAAE,CAAC;YAExD,wGAAwG;YACxG,wEAAwE;YACxE,EAAE;YACF,uGAAuG;YACvG,uGAAuG;YACvG,gGAAgG;YAChG,sFAAsF;YACtF,EAAE;YACF,oGAAoG;YACpG,yGAAyG;YACzG,qGAAqG;YACrG,6CAA6C;YAC7C,IAAI,CAAC,qBAAqB,IAAI,cAAc,CAAC,6BAA6B,EAAE,CAAC;gBACzE,MAAM,sCAAsC,CAAC;oBACzC,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;oBACtD,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB;oBACvD,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;wBACnC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;4BACzB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;wBAC3E,CAAC;wBACD,8EAA8E;wBAC9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,UAAU,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;oBAC3G,CAAC;iBACJ,CAAC,CAAC;YACP,CAAC;YAED,oDAAoD;YACpD,EAAE;YACF,wFAAwF;YACxF,qFAAqF;YACrF,sFAAsF;YACtF,yFAAyF;YACzF,oFAAoF;YACpF,+EAA+E;YAC/E,EAAE;YACF,wFAAwF;YACxF,uFAAuF;YACvF,yEAAyE;YACzE,IAAI,SAAS,EAAE,CAAC;gBACZ,qDAAqD,CAAC,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;gBAC/F,wFAAwF;gBACxF,wFAAwF;gBACxF,6CAA6C,CAAC,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;YAC3F,CAAC;YAED,IAAI,gCAAgC,EAAE,CAAC;gBACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CAAC,2HAA2H,CAAC,CAAC;gBACjJ,CAAC;gBACD,IAAI,CAAC,uBAAuB,GAAG,gCAAgC,CAAC,IAAI,CAAC,uBAAuB,EAAE;oBAC1F,SAAS,EAAE,iBAAiB;oBAC5B,YAAY,EAAE,IAAI,CAAC,YAAY;iBAClC,CAAC,CAAC;gBACH,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBAC/E,IAAI,CAAC,QAAQ,CAAC,0DAA0D,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAE9D,0FAA0F;YAC1F,EAAE;YACF,qFAAqF;YACrF,+EAA+E;YAC/E,gFAAgF;YAChF,yFAAyF;YACzF,uFAAuF;YACvF,IAAI,SAAS,EAAE,CAAC;gBACX,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,+BAA+B,CAA4C;qBACxG,QAAQ,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;oBAC/B,MAAO,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,eAAe,CAAmC;yBACrF,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC;gBACP,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YAED,oGAAoG;YACpG,yGAAyG;YACzG,IAAI,qBAAqB,GAAuC,IAAI,CAAC;YACrE,IAAI,iBAAiB,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC;gBACnD,qBAAqB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3H,CAAC;YAED,6FAA6F;YAC7F,kGAAkG;YAClG,mGAAmG;YACnG,oFAAoF;YACpF,IAAI,CAAC,qBAAqB,IAAI,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,uBAAuB,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACnI,CAAC;YAED,yFAAyF;YACzF,IAAI,CAAC,qBAAqB,IAAI,SAAS,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,+BAA+B,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;YAED,iEAAiE;YACjE,IAAI,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;YAGzD,iDAAiD;YACjD,IAAI,oBAAoB,GAAuC,EAAE,CAAC;YAElE,IAAI,SAAS,EAAE,CAAC;gBACZ,2EAA2E;gBAC3E,uFAAuF;gBACvF,0FAA0F;gBAC1F,6FAA6F;gBAC7F,0CAA0C;gBAC1C,MAAM,4BAA4B,GAAG,sCAAsC,CACvE,IAAI,CAAC,wBAAwB,CAAC,0BAA0B,EAAE,CAC7D,CAAC;gBACF,MAAM,gBAAgB,GAAG,CAAC,CAAC,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC;gBACjE,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAC,SAAS,EAAE,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClJ,oBAAoB,GAAG;oBACnB,GAAG,iBAAiB;oBACpB,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;iBAC/B,CAAC;gBAIF,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;oBACxC,iBAAiB,EAAE,iBAAiB,CAAC,MAAM;oBAC3C,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;oBACxD,sBAAsB,EAAE,oBAAoB,CAAC,MAAM;iBACtD,CAAC,CAAC;YACP,CAAC;iBAAM,CAAC;gBACJ,oBAAoB,GAAG,iBAAiB,IAAI,EAAE,CAAC;gBAE/C,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;oBACxC,iBAAiB,EAAE,CAAC;oBACpB,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;oBACxD,sBAAsB,EAAE,oBAAoB,CAAC,MAAM;iBACtD,CAAC,CAAC;YACP,CAAC;YACD,IAAG,CAAC,qBAAqB,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAC5C,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,EAClE,mBAAmB,CACtB,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,iGAAiG,CAAC,CAAC;YACrH,CAAC;YAED,gFAAgF;YAChF,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YACvD,MAAM,aAAa,GAAG,oBAAoB;gBACtC,CAAC,CAAC,oBAAoB,CAAC;oBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,8BAA8B,EAAE,IAAI,CAAC,qCAAqC;oBAC1E,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;oBACvD,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;oBAC7D,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;iBACtD,CAAC;gBACJ,CAAC,CAAC,IAAI,GAAG,EAA4D,CAAC;YAE1E,2EAA2E;YAC3E,aAAa,CAAC,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACtE,yFAAyF;YACzF,oFAAoF;YACpF,qFAAqF;YACrF,oFAAoF;YACpF,wFAAwF;YACxF,aAAa,CAAC,GAAG,CAAC,kCAAkC,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC3F,qFAAqF;YACrF,2EAA2E;YAC3E,gFAAgF;YAChF,iFAAiF;YACjF,sEAAsE;YACtE,aAAa,CAAC,GAAG,CAAC,6BAA6B,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACjF,aAAa,CAAC,GAAG,CAAC,mCAAmC,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAC7F,yGAAyG;YACzG,2GAA2G;YAC3G,aAAa,CAAC,GAAG,CAAC,oDAAoD,EAAE,kDAAkD,EAAE,CAAC,CAAC;YAC9H,8GAA8G;YAC9G,yGAAyG;YACzG,aAAa,CAAC,GAAG,CAAC,mDAAmD,EAAE,+CAA+C,EAAE,CAAC,CAAC;YAC1H,aAAa,CAAC,GAAG,CAAC,kCAAkC,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAC1F,0HAA0H;YAC1H,0FAA0F;YAC1F,4FAA4F;YAC5F,8FAA8F;YAC9F,aAAa,CAAC,GAAG,CAAC,qCAAqC,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAChG,gGAAgG;YAChG,gGAAgG;YAChG,aAAa,CAAC,GAAG,CAAC,iCAAiC,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACzF,iGAAiG;YACjG,oGAAoG;YACpG,gGAAgG;YAChG,aAAa,CAAC,GAAG,CAAC,gCAAgC,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACvF,mGAAmG;YACnG,oGAAoG;YACpG,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,0BAA0B,CAAC,mBAAmB,EAAE,EAAE,CAAC;gBAC9E,IAAI,CAAC,WAAW,CAAC,QAAQ;oBAAE,SAAS;gBACpC,MAAM,QAAQ,GAAG,+BAA+B,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAClE,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,WAAW,CAAC,GAAG,oEAAoE,QAAQ,oCAAoC,CAAC,CAAC;gBAC1K,CAAC;gBACD,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,kCAAkC,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3G,CAAC;YACD,2EAA2E;YAC3E,4EAA4E;YAC5E,uEAAuE;YACvE,aAAa,CAAC,GAAG,CAAC,8CAA8C,EAAE,4CAA4C,EAAE,CAAC,CAAC;YAClH,sFAAsF;YACtF,sFAAsF;YACtF,wFAAwF;YACxF,sFAAsF;YACtF,wEAAwE;YACxE,aAAa,CAAC,GAAG,CAAC,uCAAuC,EAAE,sCAAsC,EAAE,CAAC,CAAC;YACrG;;;;;;;;eAQG;YACH,aAAa,CAAC,GAAG,CAAC,iCAAiC,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACzF;;;;;;;;;;eAUG;YACH,IAAI,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;gBACtC,aAAa,CAAC,GAAG,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAClE;;;;;;;mBAOG;gBACH,aAAa,CAAC,GAAG,CAAC,gCAAgC,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACxF;;;;mBAIG;gBACH,aAAa,CAAC,GAAG,CAAC,qCAAqC,EAAE,mCAAmC,EAAE,CAAC,CAAC;gBAChG;;;mBAGG;gBACH,aAAa,CAAC,GAAG,CAAC,gDAAgD,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC1H,CAAC;YACD;;;;;;eAMG;YACH,aAAa,CAAC,GAAG,CACf,wCAAwC,EACxC,iCAAiC,CAC/B,gBAAgB,CAAC,cAA8B,EAC/C,8CAA8C,CAC/C,CACF,CAAC;YACF,aAAa,CAAC,GAAG,CACf,6CAA6C,EAC7C,iCAAiC,CAC/B,gBAAgB,CAAC,mBAAmC,EACpD,mDAAmD,CACpD,CACF,CAAC;YACF,oGAAoG;YACpG,mGAAmG;YACnG,qGAAqG;YACrG,oGAAoG;YACpG,mGAAmG;YACnG,kGAAkG;YAClG,sGAAsG;YACtG,sGAAsG;YACtG,mGAAmG;YACnG,qGAAqG;YACrG,oGAAoG;YACpG,uBAAuB;YACvB,gGAAgG;YAChG,iDAAiD;YACjD,IAAI,iBAAiB,IAAI,cAAc,CAAC,wBAAwB,EAAE,CAAC;gBAC/D,aAAa,CAAC,GAAG,CAAC,+BAA+B,EAAE,8BAA8B,EAAE,CAAC,CAAC;gBACrF,kGAAkG;gBAClG,yEAAyE;gBACzE,aAAa,CAAC,GAAG,CAAC,iCAAiC,EAAE,+BAA+B,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,CAAC;YAC1J,CAAC;YACD,8EAA8E;YAC9E,yFAAyF;YACzF,wFAAwF;YACxF,qFAAqF;YACrF,0FAA0F;YAC1F,oEAAoE;YACpE,EAAE;YACF,0FAA0F;YAC1F,+EAA+E;YAC/E,wFAAwF;YACxF,4FAA4F;YAC5F,2FAA2F;YAC3F,IAAI,iBAAiB,EAAE,CAAC;gBACpB,aAAa,CAAC,GAAG,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC;YACpH,CAAC;YACD,uEAAuE;YACvE,qEAAqE;YACrE,mDAAmD;YACnD,yDAAyD;YACzD,kFAAkF;YAClF,wFAAwF;YACxF,0EAA0E;YAC1E,uFAAuF;YACvF,kEAAkE;YAClE,aAAa,CAAC,GAAG,CAAC,kCAAkC,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC3F,aAAa,CAAC,GAAG,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC;YACrE,6DAA6D;YAC7D,qEAAqE;YACrE,qCAAqC;YACrC,4EAA4E;YAC5E,oEAAoE;YACpE,mEAAmE;YACnE,yDAAyD;YACzD,2DAA2D;YAC3D,aAAa,CAAC,GAAG,CAAC,8BAA8B,EAAE,8BAA8B,CAAC,CAAC;YAClF,8FAA8F;YAC9F,8FAA8F;YAC9F,+BAA+B;YAC/B,aAAa,CAAC,GAAG,CAAC,mCAAmC,EAAE,mCAAmC,CAAC,CAAC;YAC5F,aAAa,CAAC,GAAG,CAAC,gCAAgC,EAAE,gCAAgC,CAAC,CAAC;YACtF,0GAA0G;YAC1G,aAAa,CAAC,GAAG,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;YAC9E,aAAa,CAAC,GAAG,CAAC,6BAA6B,EAAE,6BAA6B,CAAC,CAAC;YAChF,qFAAqF;YACrF,aAAa,CAAC,GAAG,CAAC,8BAA8B,EAAE,8BAA8B,CAAC,CAAC;YAClF,aAAa,CAAC,GAAG,CAAC,+BAA+B,EAAE,+BAA+B,CAAC,CAAC;YACpF,+EAA+E;YAC/E,sFAAsF;YACtF,sFAAsF;YACtF,qFAAqF;YACrF,sFAAsF;YACtF,aAAa,CAAC,GAAG,CAAC,6BAA6B,EAAE,6BAA6B,CAAC,CAAC;YAChF,qFAAqF;YACrF,uFAAuF;YACvF,oFAAoF;YACpF,wFAAwF;YACxF,qFAAqF;YACrF,WAAW;YACX,aAAa,CAAC,GAAG,CAAC,2BAA2B,EAAE,2BAA2B,CAAC,CAAC;YAC5E,2EAA2E;YAC3E,+EAA+E;YAC/E,2EAA2E;YAC3E,aAAa,CAAC,GAAG,CAAC,gCAAgC,EAAE,gCAAgC,CAAC,CAAC;YACtF,2DAA2D;YAC3D,mEAAmE;YACnE,4EAA4E;YAC5E,iEAAiE;YACjE,oEAAoE;YACpE,8DAA8D;YAC9D,aAAa;YACb,aAAa,CAAC,GAAG,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;YAE9E,IAAI,iBAAiB,IAAI,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,CAAC;gBACtE,aAAa,CAAC,GAAG,CAAC,mCAAmC,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC7F,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YAED,+EAA+E;YAC/E,IAAI,eAAe,EAAE,OAAO,EAAE,CAAC;gBAC3B,aAAa,CAAC,GAAG,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACpH,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,YAAY,EAAE,eAAe,CAAC,oBAAoB,EAAE,CAAC,CAAC;YACnH,CAAC;YAED,4EAA4E;YAC5E,EAAE;YACF,sEAAsE;YACtE,oEAAoE;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,qEAAqE;YACrE,2CAA2C;YAC3C,IAAI,iBAAiB,EAAE,CAAC;gBACpB,MAAM,iBAAiB,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;gBACxF,IAAI,iBAAiB,EAAE,CAAC;oBACpB,oDAAoD;oBACpD,sDAAsD;oBACtD,6DAA6D;oBAC7D,qDAAqD;oBACrD,sDAAsD;oBACtD,sDAAsD;oBACtD,oDAAoD;oBACpD,oDAAoD;oBACpD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,WAAW,CAAC;oBACxD,MAAM,YAAY,GAAG,iBAAiB,EAAE,0BAA0B;2BAC3D,yCAAyC,CAAC;oBACjD,aAAa,CAAC,GAAG,CACb,sCAAsC,EACtC,oCAAoC,CAAC,YAAY,CAAC,CACrD,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,iDAAiD,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBACvF,CAAC;gBAED,iFAAiF;gBACjF,EAAE;gBACF,4FAA4F;gBAC5F,iFAAiF;gBACjF,6EAA6E;gBAC7E,6EAA6E;gBAC7E,iFAAiF;gBACjF,MAAM,wBAAwB,GAAG,IAAI,CAAC,wBAAwB;qBACzD,gBAAgB,EAAE;qBAClB,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE;oBACnB,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,YAAY,CAExF,CAAC;oBACF,OAAO,aAAa,EAAE,oBAAoB,EAAE,YAAY,KAAK,SAAS,CAAC;gBAC3E,CAAC,CAAC,CAAC;gBACP,IAAI,wBAAwB,EAAE,CAAC;oBAC3B,aAAa,CAAC,GAAG,CACb,8CAA8C,EAC9C,2CAA2C,EAAE,CAChD,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;gBACnE,CAAC;gBAED,wDAAwD;gBACxD,6DAA6D;gBAC7D,yCAAyC;gBACzC,0DAA0D;gBAC1D,6DAA6D;gBAC7D,+CAA+C;gBAC/C,EAAE;gBACF,2DAA2D;gBAC3D,0DAA0D;gBAC1D,uDAAuD;gBACvD,sDAAsD;gBACtD,EAAE;gBACF,yDAAyD;gBACzD,2DAA2D;gBAC3D,oDAAoD;gBACpD,uDAAuD;gBACvD,cAAc;gBACd,MAAM,WAAW,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBACjD,IAAI,WAAW,EAAE,CAAC;oBACd,aAAa,CAAC,GAAG,CACb,kCAAkC,EAClC,gCAAgC,EAAE,CACrC,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;YAElD,oGAAoG;YACpG,oGAAoG;YACpG,8FAA8F;YAC9F,oFAAoF;YACpF,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,sBAAsB,EAAE,cAAc,CAAC,CAAC;YAE5E,mFAAmF;YACnF,IAAI,IAAI,CAAC,0BAA0B,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;gBACpD,0EAA0E;gBAC1E,yEAAyE;gBACzE,4EAA4E;gBAC5E,6EAA6E;gBAC7E,0EAA0E;gBAC1E,sDAAsD;gBACtD,IAAI,SAAS,EAAE,CAAC;oBACZ,IAAI,CAAC;wBACD,MAAM,0BAA0B,GAAG,SAAS,CAAC,GAAG,CAC5C,kBAAkB,CAAC,0BAA0B,CACX,CAAC;wBACvC,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;wBAC5E,IAAI,CAAC,QAAQ,CAAC,4DAA4D,CAAC,CAAC;wBAE5E,uEAAuE;wBACvE,sEAAsE;wBACtE,2DAA2D;wBAC3D,MAAM,2BAA2B,GAAG,SAAS,CAAC,GAAG,CAC7C,kBAAkB,CAAC,2BAA2B,CACX,CAAC;wBACxC,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;wBAC7E,IAAI,CAAC,QAAQ,CAAC,6DAA6D,CAAC,CAAC;oBACjF,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uFAAuF,EAAE;4BACtG,GAAG,2BAA2B,CAAC,KAAK,CAAC;yBACxC,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBACnD,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAC/D,CAAC;iBAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC7B,IAAI,CAAC,QAAQ,CAAC,wFAAwF,CAAC,CAAC;YAC5G,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YAED,mEAAmE;YACnE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACrD,IAAI,CAAC;oBACD,8DAA8D;oBAC9D,4DAA4D;oBAC5D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,8DAA8D;oBAC9D,6DAA6D;oBAC7D,iDAAiD;oBACjD,MAAM,IAAI,CAAC,sBAAsB,CAAC,UAAU,CACxC,gBAAgB;wBACZ,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;wBACvD,CAAC,CAAC,SAAS,CAClB,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;gBAC7E,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,4DAA4D;oBAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,CAAC,CAAC;gBACjF,CAAC;gBAED,uDAAuD;gBACvD,IAAI,IAAI,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;oBAChE,IAAI,CAAC;wBACD,8BAA8B;wBAC9B,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;wBAErC,2EAA2E;wBAC3E,sEAAsE;wBACtE,4EAA4E;wBAC5E,wEAAwE;wBACxE,qEAAqE;wBACrE,2EAA2E;wBAC3E,qCAAqC;wBACrC,KAAK,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;4BAC1E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;wBACrG,CAAC,CAAC,CAAC;oBACP,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACb,wDAAwD;wBACxD,uEAAuE;wBACvE,wCAAwC;wBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;oBAClE,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,QAAQ,CAAC,iDAAiD,CAAC,CAAC;gBACrE,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;YAED;;;;;;;;;;;;;eAaG;YACH,MAAM,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAE1C,iGAAiG;YACjG,uGAAuG;YACvG,oEAAoE;YACpE,oEAAoE;YACpE,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAEhC,kFAAkF;YAClF,wFAAwF;YACxF,2BAA2B;YAC3B,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEnC,uFAAuF;YACvF,uFAAuF;YACvF,kFAAkF;YAClF,0DAA0D;YAC1D,MAAM,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAE1C,yFAAyF;YACzF,sFAAsF;YACtF,wFAAwF;YACxF,4DAA4D;YAC5D,MAAM,IAAI,CAAC,kCAAkC,EAAE,CAAC;YAEhD,iFAAiF;YACjF,0FAA0F;YAC1F,kFAAkF;YAClF,MAAM,IAAI,CAAC,gCAAgC,EAAE,CAAC;YAE9C,yFAAyF;YACzF,2FAA2F;YAC3F,yFAAyF;YACzF,yDAAyD;YACzD,IAAI,CAAC,yCAAyC,EAAE,CAAC;YAEjD,4GAA4G;YAC5G,2FAA2F;YAC3F,6EAA6E;YAC7E,MAAM,IAAI,CAAC,mCAAmC,CAC1C,SAAS,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;gBACxD,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,mBAAmB,CAA+B;gBACrF,CAAC,CAAC,SAAS,CAClB,CAAC;YAEF,kCAAkC;YAClC,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;YAEpD,sFAAsF;YACtF,wFAAwF;YACxF,wFAAwF;YACxF,wFAAwF;YACxF,yFAAyF;YACzF,oEAAoE;YACpE,EAAE;YACF,2FAA2F;YAC3F,0FAA0F;YAC1F,wFAAwF;YACxF,uFAAuF;YACvF,yFAAyF;YACzF,wFAAwF;YACxF,yFAAyF;YACzF,4FAA4F;YAC5F,wFAAwF;YACxF,EAAE;YACF,iGAAiG;YACjG,+FAA+F;YAC/F,wFAAwF;YACxF,IAAI,iBAAiB,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC9D,wFAAwF;gBACxF,gGAAgG;gBAChG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wCAAwC,CAAC;oBACjE,SAAS,EAAE,iBAAiB,CAAC,SAAS;oBACtC,0BAA0B,EAAE,iBAAiB,CAAC,UAAU,EAAE,qBAAqB;iBAClF,CAAC,CAAC;YACP,CAAC;YAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAG1B,uEAAuE;YACvE,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YAC/D,IAAI,CAAC,2BAA2B,CAAC;gBAC7B,mBAAmB,EAAE,IAAI;gBACzB,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,CAAC;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC;YACpD,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAEpC,IAAI,CAAC,QAAQ,CAAC,8DAA8D,CAAC,CAAC;QAElF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,sEAAsE;YACtE,oEAAoE;YACpE,0DAA0D;YAC1D,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH;;;;OAIG;IACK,uBAAuB,CAAC,SAAc,EAAE,gBAA6C;QACzF,wGAAwG;QACxG,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAA0C,EAAE,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;QACxI,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACzE,wGAAwG;QACxG,wEAAwE;QACxE,MAAM,kBAAkB,GAAG,IAAI,CAAC,8BAA8B,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtG,IAAI,kBAAkB;YAAE,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,6BAA6B,CAAyC,CAAC;QACzH,MAAM,uBAAuB,GAAG,IAAI,CAAC,8BAA8B,CAAC;QACpE,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAA6B,CAAC;QACvE,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAoC,CAAC;QAC3E,KAAK,MAAM,QAAQ,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACjI,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,kBAAkB,CAAC,CAAC;YAChJ,MAAM,aAAa,GAAG,OAAO;gBACzB,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,wBAAwB,CAAC,WAAW,EAAE,sCAAsC,CAAC,kBAAkB,CAAyD;gBAChM,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,SAAS,GAAG,aAAa,EAAE,SAAS,IAAI,EAAE,CAAC;YACjD,2FAA2F;YAC3F,mEAAmE;YACnE,yBAAyB,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACtF,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACvD,CAAC;QACD,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE;YAC/B,yBAAyB;YACzB,iGAAiG;YACjG,oEAAoE;YACpE,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,KAAK,CAAC;SACpG,CAAC,CAAC;QAEH,MAAM,qBAAqB,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAwC,CAAC;QAC7H,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,CAAC,iBAAiB;gBAAE,SAAS;YAC1E,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACpD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC;YAC7G,IAAI,QAAQ,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9E,MAAM,IAAI,8BAA8B,CACpC,YAAY,OAAO,CAAC,GAAG,YAAY,WAAW,IAAI,WAAW,iBAAiB,QAAQ,CAAC,UAAU,qEAAqE,CACzK,CAAC;YACN,CAAC;QACL,CAAC;QACD,IAAI,CAAC,8BAA8B,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;QAC3F,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,8BAA8B,CAClC,SAAc,EACd,QAA8C,EAC9C,gBAAwD,EACxD,eAAqD;QAErD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,oCAAoC,CAAgD,CAAC;QACvI,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,4BAA4B,CAAwC,CAAC;QACtH,MAAM,mBAAmB,GAAG,IAAI,CAAC,gCAAgC,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC5H,MAAM,oBAAoB,GAAG,IAAI,CAAC,gCAAgC,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACzI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE;YAC/D,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC7G,mBAAmB,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5E,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,KAAK,CAAC;SACpG,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,oBAAoB;YAAE,OAAO;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,gCAAgC,CAAC,0BAA0B,CAAC,oBAAoB,EAAE,sCAAsC,CAAC,sBAAsB,CAAqD,CAAC;QAC3N,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,8BAA8B,CAAC,+BAA+B,oBAAoB,2FAA2F,CAAC,CAAC;QAC7L,CAAC;QACD,QAAQ,CAAC,4BAA4B,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACzE,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,CAAC,uBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC;IACjI,CAAC;IAED;;;;OAIG;IACK,8BAA8B,CAAC,SAAc,EAAE,uBAAgC;QACnF,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,2BAA2B,CAAuC,CAAC;QACrH,iGAAiG;QACjG,MAAM,kBAAkB,GAAG,IAAI,CAAC,gCAAgC,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAC7I,IAAI,kBAAkB,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,gCAAgC,CAAC,0BAA0B,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,cAAc,CAAuD,CAAC;YAClN,iDAAiD,CAAC;gBAC9C,WAAW,EAAE,kBAAkB;gBAC/B,UAAU,EAAE,OAAO,EAAE,yBAAyB;gBAC9C,WAAW,EAAE,wCAAwC,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;aAC5G,CAAC,CAAC;QACP,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE;YAAE,OAAO,IAAI,CAAC;QACvC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC7B,IAAI,CAAC,uBAAuB;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,gCAAgC,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,aAAa,CAAE,CAAC;QACjI,MAAM,QAAQ,GAAG,IAAI,CAAC,gCAAgC,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,sBAAsB,CAAqD,CAAC;QAClN,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,8BAA8B,CAAC,+BAA+B,WAAW,2FAA2F,CAAC,CAAC;QACpL,CAAC;QACD,OAAO,qCAAqC,CAAC;YACzC,WAAW;YACX,WAAW,EAAE,QAAQ,CAAC,uBAAuB;YAC7C,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,4BAA4B,CAAwC;SACnH,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,+BAA+B,CAAC,SAAc;QACxD,MAAM,OAAO,GAAG;YACZ,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,6BAA6B,CAAyC;YACjH,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,8BAA8B,CAA0C;SACtH,CAAC;QACF,iGAAiG;QACjG,6EAA6E;QAC5E,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAyC,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACpI,IAAI,CAAC;YACD,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAiC,CAAC;YAC/G,MAAM,qBAAqB,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAwC,CAAC;YAE7H,MAAM,qBAAqB,CAAC,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,uEAAuE;YACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBAC/D,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACxC,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,yBAAyB,CACnC,SAAc,EACd,aAAmC,EACnC,qBAA2C;QAE3C,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAErD,+DAA+D;QAC/D,EAAE;QACF,4DAA4D;QAC5D,iEAAiE;QACjE,mEAAmE;QACnE,+DAA+D;QAC/D,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,0DAA0D;QAC1D,sDAAsD;QACtD,iEAAiE;QACjE,EAAE;QACF,iEAAiE;QACjE,mEAAmE;QACnE,6DAA6D;QAC7D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC;QACpE,kGAAkG;QAClG,iGAAiG;QACjG,IAAI,UAAU,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,OAAO,EAAE,wCAAwC,CAC7C,UAAU,CAAC,MAAM,EACjB,aAAa,EACb,UAAU,CAAC,MAAM,CACpB;oBACD,WAAW,EAAE,aAAa,CAAC,WAAW,IAAI,IAAI;oBAC9C,uBAAuB,EAAE,UAAU,CAAC,MAAM;iBAC7C;aACJ,CAAC,CAAC;QACP,CAAC;QACD,kGAAkG;QAClG,MAAM,kBAAkB,GAAG,UAAU,CAAC,WAAW,CAAC;QAClD,mHAAmH;QACnH,iHAAiH;QACjH,+GAA+G;QAC/G,MAAM,sBAAsB,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,8BAA8B,CAAC;YAClG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,8BAA8B,CAAiD;YAClH,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,eAAe,GAAG,sBAAsB,KAAK,SAAS;YACxD,CAAC,CAAC,UAAU,CAAC,QAAQ;YACrB,CAAC,CAAC,0BAA0B,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC7H,6HAA6H;QAC7H,iIAAiI;QACjI,0HAA0H;QAC1H,IAAI,0BAA0B,GAA+C,IAAI,CAAC;QAElF,IAAI,CAAC;YACD,4CAA4C;YAC5C,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,yBAAyB,CAAqC,CAAC;YACpH,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,CAAgC,CAAC;YAC5G,MAAM,qBAAqB,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,4BAA4B,CAAwC,CAAC;YAEpI,0FAA0F;YAC1F,MAAM,kBAAkB,GAAwB,qBAAqB,IAAI,EAAE,CAAC;YAE5E,6CAA6C;YAC7C,MAAM,WAAW,CAAC,UAAU,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;YAClE,MAAM,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAChD,iHAAiH;YACjH,mHAAmH;YACnH,iFAAiF;YACjF,MAAM,sBAAsB,GAAG,IAAI,qCAAqC,CAAC;gBACrE,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;gBACtD,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,oCAAoC,CAAgD;gBACjI,aAAa,EAAE,GAAG,EAAE,CAAC,mCAAmC,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBAC/E,WAAW,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,WAAW;aAC/C,CAAC,CAAC;YACH,mHAAmH;YACnH,iHAAiH;YACjH,oBAAoB;YACpB,MAAM,qBAAqB,CAAC,UAAU,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;YAChF,iFAAiF;YAChF,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,0CAA0C,CAAuD;iBAC9H,UAAU,CAAC,eAAe,CAAC,CAAC;YACjC;;;;;;eAMG;YACH,uBAAuB,CAAC,aAAa,CAAC,CAAC;YACvC,iGAAiG;YACjG,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,sBAAsB,CAAkC,CAAC,CAAC;YAErH,0DAA0D;YAC1D,EAAE;YACF,wFAAwF;YACxF,0FAA0F;YAC1F,wFAAwF;YACxF,uFAAuF;YACvF,qEAAqE;YACrE,SAAS;iBACJ,GAAG,CAAC,kBAAkB,CAAC,oCAAoC,CAAC;iBAC5D,QAAQ,CAAC,iCAAiC,CAAC;gBACxC,kBAAkB;gBAClB,kBAAkB,EAAE,GAAG,EAAE,CAAC,eAAe;gBACzC,6BAA6B,EAAE,KAAK,EAAE,0BAA0B,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE;oBAC5F,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,mBAAmB,CAA+B,CAAC;oBACzG,OAAO,yBAAyB,CAAC,MAAM,YAAY,CAAC,YAAY,CAC5D,0BAA0B,EAC1B,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,CAC5C,CAAwD,CAAC;gBAC9D,CAAC;gBACD,uBAAuB,EAAE,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,EAAE;oBACjG,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,mBAAmB,CAA+B,CAAC;oBACzG,OAAO,yBAAyB,CAAC,MAAM,YAAY,CAAC,YAAY,CAC5D,wBAAwB,EACxB;wBACI,CAAC,qBAAqB,CAAC,EAAE,gBAAgB;wBACzC,MAAM,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE;qBACnD,CACJ,CAA4D,CAAC;gBAClE,CAAC;gBACD,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;gBACjE;;;;;;;;;mBASG;gBACH,4BAA4B,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB;qBAC5D,gBAAgB,EAAE;qBAClB,QAAQ,CAAC,yBAAyB,CAAC,MAAM,CAAC,cAA8B,CAAC;aACjF,CAAC,CAAC,CAAC;YACR,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAE9D,4GAA4G;YAC5G,IAAI,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBAC1D,IAAI,CAAC,QAAQ,CAAC,sCAAsC,EAAE;oBAClD,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,MAAM;iBACjD,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;oBACnE,GAAG,2BAA2B,CAAC,SAAS,CAAC;iBAC5C,CAAC,CAAC;YACP,CAAC;YAED,+FAA+F;YAC/F,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,yBAAyB,CAAqC,CAAC;YACpH,MAAM,mBAAmB,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,mBAAmB,CAA+B,CAAC;YAChH,sCAAsC,CAAC,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;YAEhJ,oGAAoG;YACpG,iCAAiC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAEhE,yGAAyG;YACzG,2GAA2G;YAC3G,sGAAsG;YACtG,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAiC,CAAC;YAC/G,MAAM,cAAc,GAAG,IAAI,qBAAqB,CAAC,eAAe,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;YAC7F,cAAc,CAAC,eAAe,CAAC,aAAa,CAAC,WAAW,EAAE,4BAA4B,EAAE,cAAc,CAAC,CAAC;YAExG,MAAM,gBAAgB,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,CAAqB,CAAC;YAChG,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;YAC7C,MAAM,kBAAkB,GAAG,IAAI,uCAAuC,CAAC,IAAI,CAAC,uBAAuB,EAAE,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,2BAA2B,EAAE,sBAAsB,CAAC,CAAC;YAC7N,MAAM,eAAe,GAAG,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,CAAC,aAAa,CAAC,WAAW,EAAE,sCAAsC,CAAC,kBAAkB,CAAC;gBACjK,CAAC,CAAE,IAAI,CAAC,gCAAgC,CAAC,wBAAwB,CAAC,aAAa,CAAC,WAAW,EAAE,sCAAsC,CAAC,kBAAkB,CAA0D;oBAC5M,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,4BAA4B,CAAC;gBAClF,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,eAAe,EAAE,CAAC;gBAClB,0BAA0B,GAAG,GAAG,EAAE,CAAC,2BAA2B,CAAC;oBAC3D,WAAW,EAAE,aAAa,CAAC,WAAW;oBACtC,QAAQ,EAAE,eAAe;oBACzB,eAAe;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,qCAAqC,CAAC,iCAAiC,CAAC,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC;oBAC3K,oBAAoB,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,YAA4B,CAAC,KAAK,SAAS;iBACrI,CAAC,CAAC;YACP,CAAC;iBAAM,CAAC;gBACJ,uGAAuG;gBACvG,oGAAoG;gBACpG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,aAAa,CAAC,WAAW,0BAA0B,4BAA4B,0DAA0D,CAAC,CAAC;YACtL,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE;gBACzD,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,aAAa,EAAE,aAAa,CAAC,aAAa;aAC7C,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,qFAAqF;YACrF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,EAAE;gBACxF,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACxC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,sBAAsB,CAAC,aAAmC;QACpE,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;YACnD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,CAAC,kBAAkB,EAAE,CAAC;QAClG,CAAC;QAED,IAAI,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,8BAA8B,CAAC,kBAAkB,CAC1E,WAAW,EACX,sCAAsC,CAAC,gBAAgB,CAC1D,CAAC;YACF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;gBAChE,kEAAkE;gBAClE,iEAAiE;gBACjE,mEAAmE;gBACnE,mEAAmE;gBACnE,iEAAiE;gBACjE,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;gBACxF,OAAO;oBACH,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,sCAAsC,CAAC,iCAAiC;iBACnF,CAAC;YACN,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,CACxD,WAAW,EACX,sCAAsC,CAAC,gBAAgB,CAC1D,EAAE,CAAC;gBACA,IAAI,CAAC,QAAQ,CAAC,8DAA8D,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC/F,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,CAAC,iBAAiB,EAAE,CAAC;YACjG,CAAC;YAED,uFAAuF;YACvF,wFAAwF;YACxF,wFAAwF;YACxF,gDAAgD;YAChD,EAAE;YACF,qFAAqF;YACrF,iFAAiF;YACjF,wFAAwF;YACxF,gEAAgE;YAChE,6EAA6E;YAC7E,EAAE;YACF,8FAA8F;YAC9F,2FAA2F;YAC3F,wFAAwF;YACxF,8EAA8E;YAC9E,MAAM,cAAc,GAAG,4BAA4B,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChF,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0EAA0E,EAAE;oBACzF,WAAW;oBACX,UAAU,EAAE,eAAe,CAAC,UAAU;oBACtC,SAAS,EAAE,+BAA+B,EAAE;iBAC/C,CAAC,CAAC;gBACH,OAAO;oBACH,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,sCAAsC,CAAC,0BAA0B;oBACzE,MAAM,EAAE,eAAe,CAAC,UAAU;iBACrC,CAAC;YACN,CAAC;YAED,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC;YAC5C,MAAM,SAAS,GAAG,SAAS;gBACvB,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,CACrD,WAAW,EACX,sCAAsC,CAAC,gBAAgB,EACvD,SAAS,CACZ;gBACD,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;gBAClG,OAAO;oBACH,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,sCAAsC,CAAC,cAAc;oBAC7D,MAAM,EAAE,SAAS;iBACpB,CAAC;YACN,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;gBACjF,WAAW;gBACX,UAAU,EAAE,eAAe,CAAC,UAAU;aACzC,CAAC,CAAC;YACH,OAAO;gBACH,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC;gBAC/E,WAAW;aACd,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACvF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QACxG,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ;QACV,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QAG5C,uEAAuE;QACvE,oEAAoE;QACpE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC;QAEnC,4DAA4D;QAC5D,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAY,CAAC,CAAC;QAC1E,CAAC;IACL,CAAC;IACD;;OAEG;IACI,wBAAwB;QAC3B,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,YAAY;QACrB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;IACxC,CAAC;IAED;;OAEG;IACI,oBAAoB;QACvB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,EAAE,CAAC;IAChE,CAAC;IAED;;OAEG;IACI,uBAAuB;QAC1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,2BAA2B,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACI,2BAA2B,CAAC,UAM/B,EAAE;QACF,IAAI,CAAC,QAAQ,CAAC,0DAA0D,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,oEAAoE,CAAC,CAAC;YACpF,OAAO;QACX,CAAC;QAED,IAAI,CAAC,2BAA2B,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACI,uBAAuB;QAC1B,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;QAEnE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,oEAAoE,CAAC,CAAC;YACpF,OAAO;QACX,CAAC;QAED,IAAI,CAAC,2BAA2B,CAAC,uBAAuB,EAAE,CAAC;IAC/D,CAAC;IAED;;OAEG;IACI,4BAA4B;QAC/B,IAAI,CAAC,QAAQ,CAAC,qDAAqD,CAAC,CAAC;QAErE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO;QACX,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,EAAE,CAAC;IACvD,CAAC;IAED;;OAEG;IACI,sBAAsB;QACzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,0BAA0B,CAAC;IAC3C,CAAC;IAED;;OAEG;IACI,mBAAmB;QACtB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,uBAAuB,CAAC;IACxC,CAAC;IAED;;OAEG;IACI,aAAa;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAED;;OAEG;IACI,wBAAwB;QAC3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACO,mBAAmB,CACzB,SAAoD,EACpD,sBAAmF,EACnF,iBAA4C,yBAAyB,CAAC,mBAAmB;QAEzF,2BAA2B,CAAC;YACxB,SAAS;YACT,sBAAsB;YACtB;;;;;;;eAOG;YACH,yBAAyB,EACrB,cAAc,KAAK,yBAAyB,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,cAAc;YAC5F,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,uBAAuB;YACtC,qBAAqB,EAAE,IAAI,CAAC,oCAAoC;YAChE,UAAU,EAAE,IAAI,CAAC,yBAAyB;YAC1C,gBAAgB,EAAE,IAAI,CAAC,uBAAuB;SACjD,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;OAYG;IACH;;;;;OAKG;IACO,KAAK,CAAC,4BAA4B;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE;YACrD,mBAAmB,EAAE,QAAQ,CAAC,GAAG;YACjC,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC5B,CAAC,CAAC;IACP,CAAC;IAES,KAAK,CAAC,kBAAkB;QAC9B,MAAM,wCAAwC,CAAC;YAC3C,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,yBAAyB;SAC7C,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACO,KAAK,CAAC,qBAAqB;QACjC,oFAAoF;QACpF,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC;;;;;;;;;;;;WAYG;QACH,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,qCAAqC;YAAE,OAAO;QAE/H,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,QAAQ,CAAC,kFAAkF,CAAC,CAAC;gBAClG,OAAO;YACX,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,qCAAqC,CAAC,0BAA0B,CAAC;gBACjG,SAAS,EAAE,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,CACnE,gBAAgB,CAAC,KAAK,EACtB,qBAAqB,CAAC,IAAI,CAC7B;gBACD,cAAc,EAAE;oBACZ;wBACI,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;wBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;qBACxD;iBACJ;aACJ,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,iCAAiC,CAAC;gBACvD,gBAAgB;gBAChB,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;gBACtD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,eAAe,EAAE,gCAAgC,CAAC,IAAI,CAAC,qBAAqB,CAAC;aAChF,CAAC,CAAC;YAEH,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE;oBACjD,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;iBAC1D,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,uFAAuF;YACvF,kFAAkF;YAClF,sFAAsF;YACtF,kBAAkB;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,mFAAmF;kBACjF,kFAAkF;kBAClF,oFAAoF;kBACpF,gDAAgD,EAClD;gBACI,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;gBACvD,6BAA6B,EAAE,yBAAyB;gBACxD,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,cAAc,EAAE,CAAC,GAAG,qCAAqC,CAAC;aAC7D,CACJ,CAAC;YAEF,MAAM,IAAI,CAAC,gBAAgB,EAAE,qCAAqC,CAAC;gBAC/D,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;gBACvD,6BAA6B,EAAE,yBAAyB;gBACxD,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,cAAc,EAAE,CAAC,GAAG,qCAAqC,CAAC;aAC7D,EAAE,gBAAgB,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,uEAAuE;YACvE,IAAI,CAAC,QAAQ,CAAC,gDAAgD,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACO,KAAK,CAAC,4BAA4B;QACxC,0EAA0E;QAC1E,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC;;;;;;;;;;;;WAYG;QACH,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,qCAAqC;YAAE,OAAO;QAE/H,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC;mBAC5E,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC5F,IAAI,CAAC,QAAQ,CAAC,4FAA4F,CAAC,CAAC;gBAC5G,OAAO;YACX,CAAC;YAED,MAAM,2BAA2B,GAAG,IAAI,CAAC,2BAA2B,CAAC;YACrE,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,CAAC,+FAA+F,CAAC,CAAC;gBAC/G,OAAO;YACX,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,sCAAsC,CAAC;gBAC5D,mFAAmF;gBACnF,yFAAyF;gBACzF,wFAAwF;gBACxF,wEAAwE;gBACxE,4CAA4C;gBAC5C,2BAA2B;gBAC3B,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;gBACtD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,eAAe,EAAE,uCAAuC,CAAC,IAAI,CAAC,qBAAqB,CAAC;aACvF,CAAC,CAAC;YAEH,yFAAyF;YACzF,yFAAyF;YACzF,yFAAyF;YACzF,sFAAsF;YACtF,yEAAyE;YACzE,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,sFAAsF;sBACpF,uFAAuF;sBACvF,kFAAkF,EACpF;oBACI,4BAA4B,EAAE,UAAU,CAAC,wBAAwB,CAAC,MAAM;oBACxE,wBAAwB,EAAE,UAAU,CAAC,wBAAwB;oBAC7D,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;iBACpE,CACJ,CAAC;YACN,CAAC;YAED,IAAI,UAAU,CAAC,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE;oBAC3E,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;iBACpE,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,yFAAyF;YACzF,yFAAyF;YACzF,0FAA0F;YAC1F,2FAA2F;YAC3F,sDAAsD;YACtD,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,oFAAoF;kBAClF,oFAAoF;kBACpF,8DAA8D;kBAC9D,wFAAwF;kBACxF,qFAAqF;kBACrF,4DAA4D,EAC9D;gBACI,0BAA0B,EAAE,UAAU,CAAC,sBAAsB,CAAC,MAAM;gBACpE,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;gBACjE,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;gBACzD,oBAAoB,EAAE,gCAAgC;gBACtD,eAAe,EAAE,uCAAuC,CAAC,IAAI,CAAC,qBAAqB,CAAC;gBACpF,wBAAwB,EAAE,CAAC,GAAG,oDAAoD,CAAC;gBACnF,uBAAuB,EAAE,CAAC,GAAG,2CAA2C,CAAC;aAC5E,CACJ,CAAC;YAEF;;;;;;;;;;;;;;;;;eAiBG;YACH,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;gBACvD,IAAI,CAAC;oBACD,MAAM,IAAI,CAAC,gBAAgB,EAAE,iCAAiC,CAAC;wBAC3D,cAAc,EAAE,QAAQ,CAAC,cAAc;wBACvC,UAAU,EAAE,uCAAuC,CAAC,WAAW;wBAC/D,qBAAqB,EAAE,CAAC;wBAC5B,8EAA8E;qBAC7E,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,QAAQ,CACT,0EAA0E,EAC1E,2BAA2B,CAAC,KAAK,CAAC,CACrC,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,uEAAuE;YACvE,IAAI,CAAC,QAAQ,CAAC,+CAA+C,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QACvG,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACO,KAAK,CAAC,kCAAkC;QAC9C,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,qCAAqC;YAAE,OAAO;QAE/H,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC;gBAClF,IAAI,CAAC,QAAQ,CAAC,+FAA+F,CAAC,CAAC;gBAC/G,OAAO;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oCAAoC,CAAC;YAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,IAAI,CAAC,QAAQ,CAAC,+EAA+E,CAAC,CAAC;gBAC/F,OAAO;YACX,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,4BAA4B,EAAE,CAAC;YAC1D,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,kEAAkE;YAE1F,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE;oBACrD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,cAAc;oBAC/C,gBAAgB,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB;iBACtD,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,IAAI,UAAU,CAAC,OAAO,KAAK,mCAAmC,CAAC,OAAO,EAAE,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,qGAAqG;sBACnG,iGAAiG;sBACjG,oGAAoG;sBACpG,0FAA0F,EAC5F;oBACI,qBAAqB,EAAE,SAAS;oBAChC,oFAAoF;oBACpF,oFAAoF;oBACpF,oFAAoF;oBACpF,eAAe,EAAE,UAAU,CAAC,wBAAwB,IAAI,EAAE;iBAC7D,CACJ,CAAC;gBACF,OAAO;YACX,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,0GAA0G;kBACxG,wGAAwG;kBACxG,kGAAkG,EACpG,EAAE,qBAAqB,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CACpE,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,uEAAuE;YACvE,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7G,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACO,KAAK,CAAC,gCAAgC;QAC5C,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,qCAAqC;YAAE,OAAO;QAE/H,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,QAAQ,CAAC,qFAAqF,CAAC,CAAC;gBACrG,OAAO;YACX,CAAC;YACD,MAAM,2BAA2B,GAAG,IAAI,CAAC,2BAA2B,CAAC;YACrE,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,CAAC,mGAAmG,CAAC,CAAC;gBACnH,OAAO;YACX,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC;gBACzD,2BAA2B;gBAC3B,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;gBACtD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,+BAA+B,EAAE,gCAAgC,CAAC,IAAI,CAAC,qBAAqB,CAAC;gBAC7F,gCAAgC,EAAE,uCAAuC,CAAC,IAAI,CAAC,qBAAqB,CAAC;gBACrG,0EAA0E;gBAC1E,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACvC,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;gBACnD,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,2BAA2B,EAAE,UAAU,CAAC,uBAAuB,CAAC,MAAM;gBACtE,4BAA4B,EAAE,UAAU,CAAC,wBAAwB,CAAC,MAAM;gBACxE,+BAA+B,EAAE,UAAU,CAAC,+BAA+B;gBAC3E,gCAAgC,EAAE,UAAU,CAAC,gCAAgC;aAChF,CAAC,CAAC;YAEH,oFAAoF;YACpF,uFAAuF;YACvF,mFAAmF;YACnF,IAAI,UAAU,CAAC,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,sGAAsG;sBACpG,oGAAoG;sBACpG,0CAA0C,EAC5C,EAAE,yBAAyB,EAAE,UAAU,CAAC,yBAAyB,EAAE,CACtE,CAAC;YACN,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3G,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACO,KAAK,CAAC,mCAAmC,CAAC,YAAoD;QACpG,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,oCAAoC;YAAE,OAAO;QAE9H,IAAI,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,CAAC,wFAAwF,CAAC,CAAC;gBACxG,OAAO;YACX,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC;gBACtD,YAAY;gBACZ,QAAQ,EAAE,IAAI,CAAC,gCAAgC;gBAC/C,UAAU,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;aACtG,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,0GAA0G;sBACxG,2GAA2G;sBAC3G,gEAAgE;sBAChE,gGAAgG;sBAChG,8FAA8F;sBAC9F,sGAAsG;sBACtG,uCAAuC,EACzC;oBACI,mBAAmB,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAChG,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;iBAC9C,CACJ,CAAC;YACN,CAAC;YAED,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,2GAA2G;sBACzG,yGAAyG;sBACzG,gCAAgC,EAClC;oBACI,4BAA4B,EAAE,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAClH,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;oBACnD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;iBAC9C,CACJ,CAAC;YACN,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChF,IAAI,CAAC,QAAQ,CAAC,kFAAkF,EAAE;oBAC9F,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;iBAC9C,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,sDAAsD,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9G,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACK,yCAAyC;QAC7C,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,EAAE,oBAAoB,EAAE,CAAC;YACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,IAAI,CAAC,QAAQ,CAAC,wFAAwF,CAAC,CAAC;gBACxG,OAAO;YACX,CAAC;YAED,MAAM,UAAU,GAAG,wDAAwD,CAAC;gBACxE,sBAAsB,EAAE,QAAQ,CAAC,sBAAmF;gBACpH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;aAC9D,CAAC,CAAC;YAEH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,oEAAoE,EAAE;oBAChF,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,CAAC,MAAM;iBACrE,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,6FAA6F;kBAC3F,6FAA6F;kBAC7F,yFAAyF;kBACzF,4FAA4F;kBAC5F,0FAA0F;kBAC1F,2FAA2F;kBAC3F,yCAAyC,EAC3C;gBACI,uBAAuB,EAAE,UAAU,CAAC,MAAM;gBAC1C,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,CAAC,MAAM;gBAClE,mBAAmB,EAAE,UAAU;aAClC,CACJ,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,6FAA6F;YAC7F,IAAI,CAAC,QAAQ,CAAC,gDAAgD,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAAC,UAAsC,EAAE;QACzE,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;QAE1D,IAAI,CAAC;YACD,oCAAoC;YACpC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACV,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CACtC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT,EAAC,sBAAsB,EAAE,2BAA2B,CAAC,sCAAsC,EAAC,CAC/F,CAAC;oBACF,MAAM,KAAK,CAAC;gBAChB,CAAC;YACL,CAAC;YAED,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,EAAE,CAAC;YACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CACtC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAC,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC,EAAC,CAChG,CAAC;gBACF,MAAM,KAAK,CAAC;YAChB,CAAC;YAED,+CAA+C;YAC/C,iFAAiF;YACjF,8CAA8C;YAC9C,mEAAmE;YACnE,IAAI;YAEJ,2CAA2C;YAC3C,yEAAyE;YACzE,0CAA0C;YAC1C,+DAA+D;YAC/D,IAAI;YAEJ,8CAA8C;YAC9C,+EAA+E;YAC/E,6CAA6C;YAC7C,kEAAkE;YAClE,IAAI;YAEJ,qCAAqC;YACrC,6CAA6C;YAC7C,qDAAqD;YACrD,IAAI;YAEJ,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY;gBACnC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC;YAE7C,sEAAsE;YACtE,2CAA2C;YAC3C,gDAAgD;YAChD,2EAA2E;YAC3E,gEAAgE;YAChE,6EAA6E;YAC7E,qDAAqD;YACrD,qEAAqE;YACrE,8DAA8D;YAC9D,2EAA2E;YAC3E,qDAAqD;YACrD,6DAA6D;YAC7D,oCAAoC;YACpC,mCAAmC;YACnC,MAAM;QAEV,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,qEAAqE;YACrE,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;OAEG;IACK,iBAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CACtC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,gCAAgC,EAAE,CAC3F,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAES,0BAA0B,CAAC,OAAmC;QACpE,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IACzD,CAAC;IAES,kBAAkB,CAAC,OAAmC;QAC5D,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IACzD,CAAC;IAEO,gCAAgC,CAAC,SAAc,EAAE,QAA+C;QACpG,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACvD,OAAO;QACX,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClG,CAAC;CACJ,CAAA;AAjtGY,8BAA8B;IAD1C,UAAU,EAAE;IAcJ,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,wCAAwC,CAAC,CAAA;IACnE,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAC5D,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAChD,YAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,YAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,YAAA,MAAM,CAAC,kBAAkB,CAAC,oDAAoD,CAAC,CAAA;IAC/E,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,YAAA,MAAM,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;IACtC,YAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,YAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAC3D,YAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAC3D,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,YAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IACrD,YAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IACrD,YAAA,MAAM,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAAA;IACxD,YAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,YAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IACrD,YAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;IAC1D,YAAA,MAAM,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAAA;IACxD,YAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,YAAA,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAA;IAC/C,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAChD,YAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,YAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAK5C,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,YAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IAIrD,YAAA,MAAM,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAAA;IAWxD,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAKtD,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;IAKvD,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;IAMlE,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;IAK3E,YAAA,MAAM,CAAC,uCAAuC,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;IAK3D,YAAA,MAAM,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;qCAjFN,aAAa;QACO,uBAAuB;QACkB,wCAAwC;QAClE,+BAA+B;QACjB,yCAAyC;QAC1D,qCAAqC;QACtB,wCAAwC;QACjE,wBAAwB;QAC3B,0BAA0B;QAC1B,mBAAmB;QACR,4BAA4B;QACzB,sCAAsC;QACT,qCAAqC;QACzC,2DAA2D;QACrG,cAAc;QAClB,YAAY;QACd,kBAAkB;QACoB,qCAAqC;QACjC,uCAAuC;QACvC,uCAAuC;QACjD,yCAAyC;QAC3C,wCAAwC,sBAGxD,gCAAgC;QAChB,0BAA0B;QAChB,6CAA6C;QACxD,oCAAoC;QACnD,yBAAyB;QACrB,2BAA2B;QACnB,sCAAsC;QACrC,mCAAmC;QACzC,gCAAgC;QACzC,+BAA+B;QAK1B,8BAA8B;QAC1B,gCAAgC,sBAgBpB,2BAA2B,YAWnF,yCAAyC,sBAemC,yCAAyC;GA9FjK,8BAA8B,CAitG1C;;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAI,MAAyC;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,OAAO,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["import 'reflect-metadata';\nimport { assignDerivableOrganizationTypesAtBoot } from '~wildo-backend-lib/organizations/services/organization-type-boot-assignment.backend.utils';\nimport { injectable, inject, optional } from 'inversify';\nimport type { PersistenceAdapterType, ResourceConfiguration_InitializationFactoryMap, ResourceRelationship, ResourcesRegistry, ResourceType, RolesConfiguration, FlowsActors_Agent, ResourceConfiguration, FeatureDefinitionWithAutoRegister, FeatureConfiguration, ScopeFeatures, MilestoneDefinition, ForeignKeyFillabilityViolation, CompositionSeedabilityViolation, CompositionSeedabilityResourceInput, CompositionCascadeDeletabilityViolation, NotificationBadgeDefinition, ResourceServerInstance } from '@wildo-ai/saas-models';\nimport type { DataSeedDefinition } from '~wildo-backend-lib/data-seeding/models/data-seed.shared.schemas';\nimport type { DataSeedScopeResolver } from '~wildo-backend-lib/data-seeding/services/data-seed-scope-resolver-registry.backend.service';\nimport type { DataSeedScopeResolverRegistryBackendService } from '~wildo-backend-lib/data-seeding/services/data-seed-scope-resolver-registry.backend.service';\nimport { runDataSeedingApplicationLifecyclePasses, wireDataSeedingDeclarations } from '~wildo-backend-lib/data-seeding/services/data-seed-application-bootstrap.backend';\nimport type { FlowActorSystem_InitializationFactoryMap } from '~wildo-backend-lib/flows-actors/models/flows-actors.backend.schemas';\nimport type { FunctionTool } from '~wildo-backend-lib/flows-actors/models/function-tools.backend.definitions';\nimport type { FlowsActors_AutonomousAgentDeclaration } from '~wildo-backend-lib/flows-actors/models/autonomous-agents.backend.definitions';\nimport type { BackendProviderRegistry } from '@wildo-ai/external-connectors-private/backend';\nimport {\n createSystemOfRecordFacetResolver,\n createSystemOfRecordVendorAliasResolver,\n} from '~wildo-backend-lib/systems-of-record/system-of-record-facet-loader.backend';\nimport type { SystemsOfRecordRegistryBackendService } from '~wildo-backend-lib/systems-of-record/systems-of-record-registry.backend.service';\nimport { SYSTEMS_OF_RECORD_REGISTRY_SERVICE_TYPE } from '~wildo-backend-lib/systems-of-record/systems-of-record-registry.service-type.backend';\nimport { AdministrativeContinuityBreachDetection, ErrorType, ErrorCustomMessageReference, FeatureUnavailabilityBehavior, FeatureUnavailabilityReason, BILLING_SCOPES, ActivationCriterionType, ResourcePrimaryScope, CoreResourceType, CoreResourceOperation, CORE_APP_ROLES, CORE_ORG_ROLES, collectServiceProviderDeclarationViolations,\n collectDelegatedCapabilityRoleViolations, serviceProviderExpertApprovalDeadlinesIssues, RelationshipNature, validateRequiredForeignKeyFillability, ForeignKeyFillabilityViolationSeverity, validateCompositionSeedability, validateCompositionCascadeDeletability, collectUnclassifiedDependentLifecycleEdges, ChildLifecycleStrategy, EngineCapability, SystemOfRecordErrorCode, InboundSourceKind, FlowActorSystem_Visibility } from '@wildo-ai/saas-models';\nimport type { LifecycleConfig, OrganizationUnitNarrowingDeclaration, ReviewDeadlinesDeclaration, ServiceProviderOrganizationWideAccessDeclaration } from '@wildo-ai/saas-models';\nimport { collectApplicationResourcesWithNoPersonalDataDeclaration, type PersonalDataDeclarationSubject } from '@wildo-ai/saas-models';\nimport { validateInitiatorStampedFieldSatisfiability, type InitiatorStampedFieldViolation } from '@wildo-ai/saas-models';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ApplicationIdentityBackendService } from '~wildo-backend-lib/applications/services/application-identity.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { SYSTEM_AUDIT_PRINCIPAL } from '~wildo-backend-lib/compliance/audit-trails/utils/audit-actor.backend.utils';\nimport {\n ADMINISTRATIVELY_USABLE_USER_STATUSES,\n measureUsableSuperAdminPopulation,\n resolveSuperAdminConferringRoles,\n SUPER_ADMIN_FLOOR_MINIMUM,\n} from '~wildo-backend-lib/security/authorizations/super-admin-floor.backend.utils';\nimport {\n ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES,\n ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES,\n measureOrganizationsMissingUsableOwner,\n ORGANIZATION_OWNER_FLOOR_MINIMUM,\n resolveOrganizationOwnerConferringRoles,\n} from '~wildo-backend-lib/security/authorizations/organization-owner-floor.backend.utils';\nimport { enumeratePrivilegedAccessPopulation } from '~wildo-backend-lib/security/authorizations/privileged-access-review.backend.utils';\nimport { ApplicationRuntimeProfile, resolveApplicationRuntimeProfileBootAssertions } from '~wildo-backend-lib/config/bootstrap/application-runtime-profile.backend';\nimport {\n ApplicationOwnerOrganizationAbsence,\n type ApplicationOwnerOrganizationResolverBackendService,\n} from '~wildo-backend-lib/organizations/services/application-owner-organization-resolver.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { mongoDbIsSelectedStore } from '~wildo-backend-lib/databases/utils/mongodb-runtime-dependency.backend.utils';\nimport { describeAbuseThrottleRelaxation } from '~wildo-backend-lib/errors/utils/rate-limit-environment-relaxation.backend.utils';\nimport { ApplicationStartupConfigValidatorService } from '~wildo-backend-lib/config/services/application-startup-config-validator.backend.service';\nimport { ObservabilityBackendService } from '~wildo-backend-lib/monitoring/observability/services/observability.backend.service';\nimport type { AppConfiguration } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport type { AppConfiguration_BackendAuthored } from '~wildo-backend-lib/config/models/app-config.backend-authored.definitions';\nimport type { ProviderRuntimeArtifact } from '~wildo-backend-lib/config/models/provider-runtime-artifact.backend.schemas';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { SubjectSessionRevocationBackendService } from '~wildo-backend-lib/compliance/privacy/services/subject-session-revocation.backend.service';\nimport type { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport { resolveBackendProviderRegistry } from '~wildo-backend-lib/external-providers/services/backend-provider-loader.backend.service';\nimport { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { FeatureDefinitionRegistryBackendService } from '~wildo-backend-lib/features/services/feature-definition-registry.backend.service';\nimport { MilestoneDefinitionRegistryBackendService } from '~wildo-backend-lib/guidance/services/milestone-definition-registry.backend.service';\nimport { MilestoneConditionRegistryBackendService } from '~wildo-backend-lib/guidance/services/milestone-condition-registry.backend.service';\nimport type { MilestoneConditionFn } from '~wildo-backend-lib/guidance/services/milestone-condition-registry.backend.service';\nimport type { ValueMomentAchievementHandler } from '~wildo-backend-lib/monitoring/analytics/services/value-moment-handler-registry.backend.service';\nimport type { ValueMomentHandlerRegistryBackendService } from '~wildo-backend-lib/monitoring/analytics/services/value-moment-handler-registry.backend.service';\nimport type { ValueMomentDefinitionRegistryBackendService } from '~wildo-backend-lib/monitoring/analytics/services/value-moment-definition-registry.backend.service';\nimport { LifecycleEvaluatorBackendService } from '~wildo-backend-lib/guidance/services/lifecycle-evaluator.backend.service';\nimport { initializeLifecycleCustomImplementations } from '~wildo-backend-lib/guidance/services/lifecycle-custom-implementations.backend';\nimport { createDormancyDetectionBatch } from '~wildo-backend-lib/guidance/batches/dormancy-detection.batch.backend.service';\nimport { createDataSeedingScheduledRerunBatch } from '~wildo-backend-lib/data-seeding/batches/data-seeding-scheduled-rerun.batch.backend.service';\nimport { createExternalDataPipelineScheduledRunBatch } from '~wildo-backend-lib/external-data/batches/external-data-pipeline-scheduled-run.batch.backend.service';\nimport { createDataSeedingRunCleanupBatch } from '~wildo-backend-lib/data-seeding/batches/data-seeding-run-cleanup.batch.backend.service';\nimport { FlowsActorsRegistryService } from '~wildo-backend-lib/flows-actors/services/flows-actors-registry.service';\nimport { ResourceServerInstancesRegistryBackendService } from '~wildo-backend-lib/mcp/services/resource-server-instances-registry.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { ControllersRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/controllers-registry-handler.backend.service';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport { getManualControllersBackend } from '~wildo-backend-lib/base-classes/models/manual-controllers.backend.definition';\nimport { HttpServerBackendService } from './http-server.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport { BatchesCronjobsExecutor_BackendService } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-executor.backend.service';\nimport { BatchesCronjobsCustomExecution_Service } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { ResourceOperationCustomImplementationRegistryBackendService } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-registry.backend.service';\nimport { CoreBackend_ServiceImplementationsFactories } from '~wildo-backend-lib/resources/models/custom-service-implementations.backend.definition';\nimport { createFilesCleanupBatch } from '~wildo-backend-lib/files/batches/files-cleanup.batch.backend.service';\nimport { createConsumableTokensCleanupBatch } from '~wildo-backend-lib/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service';\nimport { createOrganizationOnboardingOperationsCleanupBatch } from '~wildo-backend-lib/organizations/batches/organization-onboarding-operations-cleanup.batch.backend.service';\nimport { createSystemOfRecordWriteAdmissionsCleanupBatch } from '~wildo-backend-lib/systems-of-record/system-of-record-write-admissions-cleanup.batch.backend.service';\nimport { createA2AAbandonedTaskSweepBatch } from '~wildo-backend-lib/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service';\nimport { createApprovalPauseExpirySweepBatch } from '~wildo-backend-lib/flows-actors/batches/approval-pause-expiry-sweep.batch.backend.service';\nimport { createDecisionDeadlineSweepBatch } from '~wildo-backend-lib/flows-actors/batches/decision-deadline-sweep.batch.backend.service';\nimport { createInterruptedTurnSweepBatch } from '~wildo-backend-lib/flows-actors/batches/interrupted-turn-sweep.batch.backend.service';\nimport { autonomousAgentScheduleBatchRef, createAutonomousAgentScheduleBatch } from '~wildo-backend-lib/flows-actors/batches/autonomous-agent-schedule.batch.backend.service';\nimport { createAnonymousSessionCleanupBatch } from '~wildo-backend-lib/security/authentications/batches/anonymous-session-cleanup.batch.backend.service';\nimport { createChildLifecycleTeardownBatch } from '~wildo-backend-lib/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service';\nimport { createOrganizationMemberInvitationSweepBatch } from '~wildo-backend-lib/organizations/batches/organization-member-invitation-sweep.batch.backend.service';\nimport { createCredentialExpirySweepBatch } from '~wildo-backend-lib/base-classes/services/batches/credential-expiry-sweep.batch.backend.service';\nimport { createUsageFlushBatch } from '~wildo-backend-lib/billing/batches/usage-flush.batch.backend.service';\nimport { createBillingReconciliationBatch } from '~wildo-backend-lib/billing/batches/billing-reconciliation.batch.backend.service';\nimport { createBillingEffectOutboxRelayBatch } from '~wildo-backend-lib/billing/batches/billing-effect-outbox-relay.batch.backend.service';\nimport { createBillingSubscriptionMutationRecoveryBatch } from '~wildo-backend-lib/billing/batches/billing-subscription-mutation-recovery.batch.backend.service';\nimport type { BillingSubscriptionMutationRecoveryBackendService } from '~wildo-backend-lib/billing/services/billing-subscription-mutation-recovery.backend.service';\nimport { createSuspensionReactivationSweepBatch } from '~wildo-backend-lib/base-classes/services/batches/suspension-reactivation-sweep.batch.backend.service';\nimport { createResourceRetentionSweepBatch } from '~wildo-backend-lib/base-classes/services/batches/resource-retention-sweep.batch.backend.service';\nimport { createRetentionClassSweepBatch, reportRetentionClassPositionsAtStartup } from '~wildo-backend-lib/base-classes/services/batches/retention-class-sweep.batch.backend.service';\nimport { createOrganizationPurgeBatch } from '~wildo-backend-lib/organizations/batches/organization-purge.batch.backend.service';\nimport { createModelCostPeriodCloseBatch } from '~wildo-backend-lib/flows-actors/batches/model-cost-period-close.batch.backend.service';\nimport { isScimProvisioningEnabledForAnyOrgType } from '~wildo-backend-lib/organizations/services/scim-provisioning-gate.backend.utils';\nimport { emailBatchSendService } from '~wildo-backend-lib/notifications/email/services/email-batch-send.batch.backend.service';\nimport { m2mWebhookDeliveryBatchService } from '~wildo-backend-lib/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service';\nimport { inboundDeliveryDispatchBatchService, inboundDeliverySweepBatchService } from '~wildo-backend-lib/inbound/batches/inbound-delivery.batch.backend.service';\nimport { InboundHandlerDeclarationError, type InboundHandlerRegistryBackendService } from '~wildo-backend-lib/inbound/services/inbound-handler-registry.backend.service';\nimport type { InboundDeliveryReceiverBackendService } from '~wildo-backend-lib/inbound/services/inbound-delivery-receiver.backend.service';\nimport type { AnyInboundHandlerDefinition } from '~wildo-backend-lib/inbound/models/inbound-handler.backend.definitions';\nimport { isInboundChannelHandler, type AnyDeclaredInboundHandler } from '~wildo-backend-lib/inbound/models/inbound-channel-handler.backend.definitions';\nimport type { InboundChannelHandlerRegistryBackendService } from '~wildo-backend-lib/inbound/services/inbound-channel-handler-registry.backend.service';\nimport type { InboundChannelRuntimeBackendService } from '~wildo-backend-lib/inbound/services/inbound-channel-runtime.backend.service';\nimport { emailDomainRecheckBatchService, inboundReplySendBatchService, inboundReplySweepBatchService } from '~wildo-backend-lib/inbound/batches/inbound-reply.batch.backend.service';\nimport { createInboundEmailNotificationHandler } from '~wildo-backend-lib/inbound/email/inbound-email-notification-handler.backend';\nimport type { InboundEmailProviderBackendService } from '~wildo-backend-lib/inbound/email/inbound-email-provider.backend.service';\nimport type { InboundEmailReceptionBackendService } from '~wildo-backend-lib/inbound/email/inbound-email-reception.backend.service';\nimport { readDeclaredOutboundAdmissionEnvironment } from '~wildo-backend-lib/security/ssrf/outbound-target-admission.backend.utils';\nimport { assertNoProviderBaseUrlOverrideOutsideDevelopment } from '~wildo-backend-lib/external-providers/services/provider-base-url-override.backend.utils';\nimport { a2aPushDeliveryBatchService } from '~wildo-backend-lib/flows-actors/a2a/batches/a2a-push-delivery.batch.backend.service';\nimport { siemWebhookDeliveryBatchService } from '~wildo-backend-lib/compliance/audit-trails/batches/siem-webhook-delivery.batch.backend.service';\nimport { siemDeliveryFlushBatchService } from '~wildo-backend-lib/compliance/audit-trails/batches/siem-delivery-flush.batch.backend.service';\nimport { immudbAuditReconcileBatchService } from '~wildo-backend-lib/compliance/audit-trails/batches/immudb-audit-reconcile.batch.backend.service';\nimport { auditLogsArchiveBatchService } from '~wildo-backend-lib/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service';\nimport { LAYER2_AUDIT_FAN_OUT_ACTIVE_MESSAGE, shouldRecordLayer2AuditFanOutActive, shouldWarnLayer2AuditProviderInactive } from '~wildo-backend-lib/compliance/audit-trails/utils/layer2-audit-provider-boot-diagnostic.backend.utils';\nimport { listSupportedBillingSdkPackages, resolveBillingAdapterFactory } from '~wildo-backend-lib/billing/services/billing-adapter-registry.backend';\nimport { recordBillingProviderCalls } from '~wildo-backend-lib/billing/services/billing-provider-call-recording.backend';\nimport type { ProviderCapabilityCallRecorderBackendService } from '~wildo-backend-lib/external-providers/capability-calls/provider-capability-call-recorder.backend';\n// Internal callers go through the path alias (the `@wildo-ai/saas-backend-lib/custom-batch-manifests`\n// subpath export exists for external spec-layer consumers; self-imports through the public\n// package name are not wired in this workspace's tsconfig path map).\nimport {\n ANONYMOUS_SESSION_CLEANUP_BATCH_REF,\n APPROVAL_PAUSE_EXPIRY_SWEEP_BATCH_REF,\n DECISION_DEADLINE_SWEEP_BATCH_REF,\n INTERRUPTED_TURN_SWEEP_BATCH_REF,\n ORGANIZATION_MEMBER_INVITATION_SWEEP_BATCH_REF,\n CREDENTIAL_EXPIRY_SWEEP_BATCH_REF,\n USAGE_FLUSH_BATCH_REF,\n BILLING_RECONCILIATION_BATCH_REF,\n BILLING_EFFECT_OUTBOX_RELAY_BATCH_REF,\n BILLING_SUBSCRIPTION_MUTATION_RECOVERY_BATCH_REF,\n SUSPENSION_REACTIVATION_SWEEP_BATCH_REF,\n JOB_EXECUTIONS_RETENTION_SWEEP_BATCH_REF,\n JOB_PAYLOAD_STORAGE_RETENTION_SWEEP_BATCH_REF,\n ENGINE_JOB_EXECUTIONS_RETENTION_SWEEP_MANIFEST,\n ENGINE_JOB_PAYLOAD_STORAGE_RETENTION_SWEEP_MANIFEST,\n RETENTION_CLASS_SWEEP_BATCH_REF,\n MODEL_COST_PERIOD_CLOSE_BATCH_REF,\n ORGANIZATION_PURGE_BATCH_REF,\n CONSUMABLE_TOKENS_CLEANUP_BATCH_REF,\n ORGANIZATION_ONBOARDING_OPERATIONS_CLEANUP_BATCH_REF,\n SYSTEM_OF_RECORD_WRITE_ADMISSIONS_CLEANUP_BATCH_REF,\n A2A_ABANDONED_TASK_SWEEP_BATCH_REF,\n DATA_SEEDING_RUN_CLEANUP_BATCH_REF,\n DATA_SEEDING_SCHEDULED_RERUN_BATCH_REF,\n DATA_SEEDING_SCHEDULED_RERUN_DEFAULT_CRON,\n EXTERNAL_DATA_PIPELINE_SCHEDULED_RUN_BATCH_REF,\n DORMANCY_DETECTION_BATCH_REF,\n CHILD_LIFECYCLE_TEARDOWN_BATCH_REF,\n EMAIL_BATCH_SEND_BATCH_REF,\n FILES_CLEANUP_BATCH_REF,\n M2M_WEBHOOK_DELIVERY_BATCH_REF,\n INBOUND_DELIVERY_DISPATCH_BATCH_REF,\n INBOUND_REPLY_SEND_BATCH_REF,\n INBOUND_REPLY_SWEEP_BATCH_REF,\n EMAIL_DOMAIN_RECHECK_BATCH_REF,\n INBOUND_DELIVERY_SWEEP_BATCH_REF,\n A2A_PUSH_DELIVERY_BATCH_REF,\n SIEM_WEBHOOK_DELIVERY_BATCH_REF,\n SIEM_DELIVERY_FLUSH_BATCH_REF,\n IMMUDB_AUDIT_RECONCILE_BATCH_REF,\n AUDIT_LOGS_ARCHIVE_BATCH_REF,\n RAG_RECONCILIATION_SWEEP_BATCH_REF,\n RAG_EMBEDDING_DRAIN_BATCH_REF,\n} from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { createRagReconciliationSweepBatch } from '~wildo-backend-lib/rag/batches/rag-reconciliation-sweep.batch.backend.service';\nimport { createRagEmbeddingDrainBatch } from '~wildo-backend-lib/rag/batches/rag-embedding-drain.batch.backend.service';\nimport { SAAS_SERVICE_TYPES as TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport { MongoDBService } from '~wildo-backend-lib/databases/services/mongodb.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { I18nBackendService, CustomLabelsMap } from '~wildo-backend-lib/i18n/services/i18n.backend.service';\nimport { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport { PdfTemplateBindingBackendService } from '~wildo-backend-lib/pdf-templates/services/pdf-template-binding.backend.service';\nimport type { PdfTemplateBindingsMap } from '~wildo-backend-lib/pdf-templates/models/pdf-template-binding';\nimport type { PdfCollectionTemplateDefinition } from '~wildo-backend-lib/pdf-templates/models/pdf-collection-template-definition';\nimport { PdfCollectionExportTemplateBackendService } from '~wildo-backend-lib/pdf-templates/services/pdf-collection-export-template.backend.service';\nimport { QueueWorkerInitializerBackendService } from '~wildo-backend-lib/queue/queue-worker-initializer.backend.service';\nimport { CronJobSyncBackendService } from '~wildo-backend-lib/queue/cron-job-sync.backend.service';\nimport type { ProductCatalogSyncBackendService } from '~wildo-backend-lib/billing/services/back-office/product-catalog-sync.backend.service';\nimport type { UsageMeteringBackendService } from '~wildo-backend-lib/billing/services/back-office/usage-metering.backend.service';\nimport type { BillingReconciliationBackendService } from '~wildo-backend-lib/billing/services/back-office/billing-reconciliation.backend.service';\nimport {\n createBillingSubjectErasureEffect,\n TERMINAL_SUBSCRIPTION_STATUSES,\n} from '~wildo-backend-lib/billing/services/back-office/billing-subject-erasure-effect.backend';\nimport { BILLING_SCOPE_TO_VARIANTS } from '~wildo-backend-lib/billing/services/custom-impl/billing-custom-impl-utils.backend';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { measureStoredProviderCredentialSlots } from '~wildo-backend-lib/security/connected-accounts/utils/retired-credential-slot.backend.utils';\nimport type { BillingFeatureSyncBackendService } from '~wildo-backend-lib/billing/services/back-office/billing-feature-sync.backend.service';\nimport { initializeBillingCustomImplementations, registerBillingPostOperationHooks, setBillingWebSocketService, setReferralProgramService, setUsageMeteringService } from '~wildo-backend-lib/billing/services/custom-impl/billing-custom-implementations.backend';\nimport type { ReferralProgramBackendService } from '~wildo-backend-lib/billing/services/referrals/referral-program.backend.service';\nimport { registerOrganizationProviderCredentialCascadeEvidence } from '~wildo-backend-lib/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service';\nimport { registerUserProviderCredentialCascadeEvidence } from '~wildo-backend-lib/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service';\nimport { ExternalProvider_ExchangeProtocol_Kind, type Hook_Endpoint, type StandardBilling_Interface, ProviderProtocolRuntimeKind } from '@wildo-ai/external-connectors-models';\nimport type { WebhookHandlerBackendService } from '~wildo-backend-lib/notifications/webhooks/services/webhook-handler.backend.service';\nimport type { WebhookAutoControllerBackendService } from '~wildo-backend-lib/notifications/webhooks/controllers/webhook-auto-controller.backend.service';\nimport { BillingWebhookAdapter } from '~wildo-backend-lib/billing/services/webhooks/billing-webhook-adapter.backend.service';\nimport { BILLING_WEBHOOK_ENDPOINT_KEY, createBillingInboundHandler } from '~wildo-backend-lib/billing/services/webhooks/billing-inbound-handler.backend';\nimport { BillingWebhookEventRouterBackendService } from '~wildo-backend-lib/billing/services/webhooks/billing-webhook-event-router.backend.service';\nimport { BillingSubscriptionProviderProjection } from '~wildo-backend-lib/billing/services/billing-subscription-provider-projection.backend';\nimport { resolveBillingMutationApplicationId } from '~wildo-backend-lib/billing/services/billing-subscription-mutation-store.backend';\nimport type { ResourcePersistenceUnitOfWorkBackendService } from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport type { WebSocketService } from '~wildo-backend-lib/requests/service/websocket.service';\nimport type { BillingConfiguration, ProductDefinition, ChartDefinition, GuidanceFlowDefinition } from '@wildo-ai/saas-models';\nimport { ChartRegistryBackendService } from '~wildo-backend-lib/charts/services/chart-registry.backend.service';\nimport { GuidanceTriggerEvaluatorBackendService } from '~wildo-backend-lib/guidance/services/guidance-trigger-evaluator.backend.service';\nimport { DataSeedRegistryBackendService } from '~wildo-backend-lib/data-seeding/services/data-seed-registry.backend.service';\nimport { DataSeedDispatcherBackendService } from '~wildo-backend-lib/data-seeding/services/data-seed-dispatcher.backend.service';\nimport { DataSeedingAdminBackendController } from '~wildo-backend-lib/data-seeding/controllers/data-seeding-admin.backend.controller';\nimport { ExternalDataAdminBackendController } from '~wildo-backend-lib/external-data/controllers/external-data-admin.backend.controller';\nimport { EmailTemplateRegistryBackendService } from '~wildo-backend-lib/notifications/email/services/email-template-registry.backend.service';\nimport type { EmailTemplateDefinitionsMap } from '~wildo-backend-lib/notifications/email/models/email-template-definition';\nimport { BillingStateBackendService } from '~wildo-backend-lib/billing/services/back-office/billing-state.backend.service';\nimport { resolveFeatureGatedCoreResourceExclusions } from '~wildo-backend-lib/runtime/utils/feature-gated-core-resource-exclusions.backend.utils';\nimport { resolveApplicationConfigForStartup } from '~wildo-backend-lib/runtime/utils/application-startup-config-access.backend.utils';\n\n\n\n/**\n * Configuration object for {@link StartApplicationBackendService.initialize}.\n *\n * Groups the 25+ positional parameters into a single typed config,\n * preventing silent mis-ordering bugs (e.g. `customLabels` passed as `undefined`\n * at the wrong positional slot).\n */\nexport interface ApplicationInitializationConfig {\n sharedResourceConfigurations: ResourceConfiguration_InitializationFactoryMap;\n sharedResourceFieldIdentifiers?: Record<string, string>;\n sharedResourceRelationships: ResourceRelationship[];\n\n backendResourceConfigurations?: ResourceConfiguration_InitializationFactoryMap;\n backendResourceFieldIdentifiers?: Record<string, string>;\n backendResourceRelationships?: ResourceRelationship[];\n\n /**\n * App-declared notification badge definitions (merged with the framework's\n * `coreNotificationBadgeDefinitions` in the registry). DERIVED_QUERY badges\n * are recomputed by the dispatcher on source-resource mutations + on connect.\n */\n notificationBadgeDefinitions?: NotificationBadgeDefinition[];\n\n /**\n * Resources this application narrows by ORGANIZATION UNIT, keyed by resource type.\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege confinement of a\n * unit-scoped principal to the records of their unit.\n *\n * Naming a resource here admits a caller whose authority for it comes ONLY from an organization\n * unit grant, and then confines every read and write to the rows of the units that grant covers.\n * ADDITIVE: a caller whose organization-wide role already satisfies the operation is not narrowed\n * at all, so opting a resource in can never shrink a result set someone could already see.\n *\n * `unitFieldName` must name a real field on that resource's schema holding the owning\n * `ORGANIZATION_UNITS` id. The authorization plane (membership, unit membership, units themselves,\n * and roles-bearing machine credentials) may never be declared here — startup fails closed if it\n * is, because a resource that ISSUES authority must not be governed by the authority it issues.\n */\n organizationUnitNarrowing?: Readonly<Partial<Record<string, OrganizationUnitNarrowingDeclaration>>>;\n\n /**\n * Resources a UNIT-scoped service-provider expert may READ across the whole client organization even\n * though they do not narrow by unit — a shared reference list, say (#1597). Each entry names its\n * rationale. Startup refuses the authorization plane and any resource that narrows by unit. Absent ⇒ a\n * unit-scoped expert reaches only resources that narrow by unit, and every other resource answers as if\n * they were not a member (fail closed).\n */\n serviceProviderOrganizationWideAccess?: Readonly<Partial<Record<string, ServiceProviderOrganizationWideAccessDeclaration>>>;\n\n customServiceImplementations: ResourceCustomServiceImplementationFactory[];\n\n\n customRoles?: RolesConfiguration;\n customControllers?: AbstractControllerBackendService[];\n container?: any;\n controllerWhiteList?: string[];\n isPlatformApplication?: boolean;\n /**\n * PLATFORM MODE ONLY (refused otherwise): the persistence adapter the platform service's OWN\n * resources are built on. Platform startups hydrate `AppConfigurationService` AFTER\n * `super.initialize()`, so the normal config-driven adapter resolution cannot see their choice\n * at repository-construction time — this passes the answer the platform already holds from its\n * Phase-1 bridged config. See `RepositoriesRegistryHandlerBackendService.platformModeDefaultAdapter`\n * for the full ordering rationale (Phase 5.2, D7). Non-platform applications declare their\n * adapter in application config (`DATABASE_DEFAULT_ADAPTER`); a second knob here would smuggle\n * the decision past that contract, which is why passing it without `isPlatformApplication`\n * throws.\n */\n platformPersistenceAdapter?: PersistenceAdapterType;\n\n customBatchesFactory?: (deps: {\n logger: LoggerService;\n errorBuilder: ErrorBuilderBackendService;\n errorHandler: ErrorHandlerService;\n executionContextCreatorService: ExecutionContextCreatorBackendService;\n resourcesRegistryService: ResourcesRegistryBackendService;\n repositoriesRegistryService: RepositoriesRegistryHandlerBackendService;\n servicesRegistryService: ServicesRegistryHandlerBackendService;\n }) => Map<string, BatchesCronjobsCustomExecution_Service<any, any>>;\n\n flowsActorsRegistry?: {\n flowActorSystemsFactoryMap?: FlowActorSystem_InitializationFactoryMap;\n agents?: FlowsActors_Agent[];\n functionTools?: FunctionTool[];\n /** Agents that may run unattended once a tenant binds a client to them (#1611). */\n autonomousAgents?: FlowsActors_AutonomousAgentDeclaration[];\n };\n\n /**\n * App-declared NAMED external resource-server instances (R-2): multiple MCP servers and/or A2A\n * agents, each served at its own URL segment with its own RFC 8707 audience, discovery document,\n * and curated content (MCP tools via `operation.mcp.servers`; A2A skills via `actorSystemRefs`).\n *\n * Purely ADDITIVE — the unnamed default `/mcp` and `/a2a` surfaces always exist and are not\n * declared here. Membership refs are validated against the resource + actor-system registries at\n * startup, so a ref typo is a startup failure rather than a silently-empty surface.\n */\n resourceServerInstances?: ResourceServerInstance[];\n\n customLabels?: CustomLabelsMap;\n backendProviderRegistry?: BackendProviderRegistry;\n\n customFeatureDefinitions?: FeatureDefinitionWithAutoRegister[];\n customFeatureConfiguration?: {\n profiles?: Record<string, ScopeFeatures>;\n defaultProfile?: string;\n unavailabilityPolicy?: Partial<FeatureConfiguration['unavailabilityPolicy']>;\n };\n\n chartDefinitions?: ChartDefinition[];\n customMilestoneDefinitions?: MilestoneDefinition[];\n customMilestoneConditions?: Array<{ ref: string; fn: MilestoneConditionFn }>;\n /**\n * Backend handlers a value moment's `onAchieved.backendHandler` can name.\n *\n * `ValueMomentHandlerRegistryBackendService` existed, was bound, and was injected into the\n * engine — and NOTHING could call `registerHandler`, so the per-moment callback surface was\n * unreachable by construction (#414). This is that path, shaped like\n * `customMilestoneConditions` beside it because it answers the same question: a declaration\n * names a function by ref, and the application supplies the function.\n */\n valueMomentHandlers?: Array<{ ref: string; fn: ValueMomentAchievementHandler }>;\n productDefinitions?: ProductDefinition[];\n emailTemplateDefinitions?: EmailTemplateDefinitionsMap;\n /** Generated provider topology module imported by the application package. */\n providerRuntime?: ProviderRuntimeArtifact;\n /**\n * Backend-only generated PDF template bindings.\n *\n * Shared `z_file({ generation })` metadata carries only a stable\n * `templateId` because resource schemas are consumed by frontend,\n * specification, and companion surfaces. The live React-PDF template object\n * stays here, in backend startup configuration, and is validated against the\n * already-initialized resource registry before services/controllers accept\n * traffic.\n */\n pdfTemplateBindings?: PdfTemplateBindingsMap;\n /**\n * Collection-export PDF templates (#1645): each renders the rows of a LIST/SEARCH export that\n * declares `collectionExport: { formats: [PDF], pdfTemplateId }`. Checked at boot against every\n * export that names one, in both directions.\n */\n pdfCollectionExportTemplates?: readonly PdfCollectionTemplateDefinition<any, any>[];\n backendConfig?: AppConfiguration_BackendAuthored;\n guidanceFlowDefinitions?: GuidanceFlowDefinition[];\n\n /**\n * Declarative data-seed definitions collected from `BackendDomainModule.seeds`.\n *\n * Consumed by the `DataSeedRegistry` / `DataSeedDispatcher` to run\n * application-lifecycle seeds at boot (Step 7.7) and resource-lifecycle /\n * lazy seeds at request time. See `.cursor/plans/seeding-first-class.md`.\n */\n dataSeeds?: DataSeedDefinition[];\n\n /**\n * Phase 7 / Item 47 (cron scheduler) — Slice 3.\n *\n * Custom scope-iteration callbacks aggregated from each module's\n * `BackendDomainModule.dataSeedScopeResolvers`. Forwarded to\n * `wireDataSeedingDeclarations` (Step 5.9), which calls\n * `DataSeedScopeResolverRegistryBackendService.registerResolvers` once\n * per boot.\n *\n * Cron seeds with `schedule.iterationStrategy === CUSTOM_RESOLVER`\n * resolve their `relatedId` rows via the resolver registered under the\n * matching `customResolverKey`.\n */\n dataSeedScopeResolvers?: Record<string, DataSeedScopeResolver>;\n\n /**\n * Inbound handlers collected from `BackendDomainModule.inboundHandlers` (#1596). Validated and\n * registered FATALLY at Step 4.55, before the webhook auto-controller mounts any route.\n */\n inboundHandlers?: AnyDeclaredInboundHandler[];\n\n /**\n * WHICH RUNTIME is booting this lifecycle, which determines which boot\n * ASSERTIONS apply. Defaults to\n * {@link ApplicationRuntimeProfile.APPLICATION_BACKEND}, so a host that does\n * not declare a profile is over-validated rather than under-validated.\n *\n * Distinct from {@link headlessMode} and its siblings: those control which\n * subsystems START, this controls which DECLARATION CLASSES are asserted to\n * be complete. See `application-runtime-profile.backend.ts`.\n */\n runtimeProfile?: ApplicationRuntimeProfile;\n /** Skip HTTP server initialization (used by apps-manager for E2E testing) */\n headlessMode?: boolean;\n /** Skip cron-job sync for non-HTTP runtimes like minions. */\n skipCronSync?: boolean;\n /**\n * Skip the shared application job consumers for runtimes that connect to\n * RabbitMQ only for their own dedicated topology (default: `false`).\n *\n * The canonical opt-in is a `BackgroundRuntimeType.MINION`: it reuses the\n * full backend startup lifecycle but must consume ONLY its own\n * `minion-tick.<name>` queue, never the shared operations/scheduled/callbacks\n * queues. When `true`, the queue-worker initializer still connects to the\n * broker (the minion's tick consumer needs that connection) but does NOT run\n * `jobConsumer.startConsuming()` — otherwise RabbitMQ would round-robin each\n * scheduled-cron tick between the backend-api pod and the minion, and the\n * minion would dead-letter every tick it cannot interpret (~50% loss).\n *\n * Sibling of {@link skipCronSync}; both default `false` so backend-api is\n * unaffected. Never set on the primary backend-api runtime.\n */\n skipJobConsumers?: boolean;\n /**\n * Runtime-specific decorator hook for the services registry.\n *\n * Used by the minion kernel to install resource-access enforcement without\n * changing the backend-api DI graph.\n */\n servicesRegistryDecoratorFactory?: (\n registry: ServicesRegistryHandlerBackendService,\n context: {\n appConfig: AppConfiguration;\n errorBuilder: ErrorBuilderBackendService;\n },\n ) => ServicesRegistryHandlerBackendService;\n /**\n * Runtime-specific hook that runs immediately after the resource catalog is\n * initialized and before downstream registries (services, flows/actors, controllers)\n * are installed.\n *\n * Minion startup uses this to cross-validate its `resourceAccess` whitelist\n * against the live application resource catalog.\n */\n afterResourcesRegistryInitialized?: (context: {\n appConfig: AppConfiguration;\n resourcesRegistryService: ResourcesRegistryBackendService;\n errorBuilder: ErrorBuilderBackendService;\n }) => Promise<void> | void;\n\n /**\n * Caller-supplied `<scope>.<name>` identifier for THIS backend process.\n * Runtime provider selection is now expected to come from materialized\n * provider-scope artifacts. Examples:\n * - `'services.backend-api'` for a regular backend service\n * - `'minions.marketingScrapper'` for a minion process\n * - `'workers.myRustWorker'` for a worker process\n *\n * Each app's bootstrap (`index.ts`) is responsible for choosing\n * the correct value. The current runtime keeps the field so the\n * materializer can bind the process to its provider scope without\n * inferring from `SERVICE_NAME`.\n */\n serviceIdentifier?: string;\n}\n\n/**\n * Start Application Backend Service\n *\n * Orchestrates the initialization of the backend application by:\n * 1. Initializing application configuration\n * 1.5. Initializing roles configuration (defaults + custom roles)\n * 2. Initializing resources registry with all 4 sources\n * 3. Initializing repositories registry with mongoose models\n * 4. Initializing services registry with business logic layer\n * 5. Initializing controllers registry with HTTP endpoints layer\n * 6. Initializing HTTP server with Express.js and middleware\n * 7. Validating all components are properly initialized\n *\n * This service ensures proper startup sequence and dependency management.\n */\n\n/** @wildo_source:part:start saas.backend.billing.resolution-failure-reasons facet:layer:backend facet:family:billing */\n/**\n * Why billing-provider resolution failed at startup. Each reason maps 1:1 to a\n * DISTINCT config surface an app author must fix, so `billing.enabled: true`\n * that cannot resolve a provider fails LOUD with an actionable message instead\n * of the historical catch-all (\"set providerRef + its secret\") that misdirected\n * authors to the secret when the real gap was backend-scope authoring.\n *\n * Read this as a debugging map — the fatal startup message names the surface,\n * and each reason below is the surface:\n * - PROVIDER_REF_UNSET → `billing.providerRef` in `./backend-api/src/saas-config.backend.ts`\n * - PROVIDER_NOT_REACHABLE_ON_BACKEND → author the ref under `providers.scopes.backend` in `./wildo.saas.config.ts` (the classic trap: authored only in a frontend scope), then `wildo config sync`. An engine-shipped or package-shipped provider needs NO hand-authored contribution: discovery reads the provider package's own `./companion` barrel and derives the backend target from that scope\n * - PROVIDER_DISABLED → the ref resolves but is disabled for the BILLING protocol in external-provider config\n * - SECRET_MISSING → the env var named by the provider's `secretRef` is absent from the per-env `providerEnv` secrets\n * - NO_ADAPTER_FOR_SDK_PACKAGE → the engine ships no billing adapter for the `sdkPackage` the provider declares. The one reason here that is NOT a config surface — no application edit fixes it\n * - RESOLUTION_ERROR → the provider threw while resolving (registry / billing-SDK fault)\n */\nenum BillingProviderResolutionFailureReason {\n /** `billing.enabled` is true but `billing.providerRef` is unset. */\n PROVIDER_REF_UNSET = 'provider-ref-unset',\n /**\n * `providerRef` is set, but no billing runtime contract is exposed to the\n * backend registry for it — the provider is not in the generated\n * provider-runtime artifact this host loads, so it was filtered out of the\n * active catalog.\n *\n * Almost always one of two things: the ref is not authored under\n * `providers.scopes.backend` (the common trap — it is authored only in a\n * frontend scope), or the artifact has not been regenerated since it was.\n *\n * A ref that is scoped but that discovery cannot supply for this runtime is\n * NOT this reason: `validateDiscoveredSaasProviderContributions` refuses that\n * at `wildo config sync`, naming the scope, long before a boot.\n */\n PROVIDER_NOT_REACHABLE_ON_BACKEND = 'provider-not-reachable-on-backend',\n /** The provider resolves but is disabled by external-provider configuration. */\n PROVIDER_DISABLED = 'provider-disabled',\n /** The provider resolves but its secret (env var `secretRef`) is absent. */\n SECRET_MISSING = 'secret-missing',\n /**\n * The provider is reachable, enabled and holds its secret, but the engine ships no billing\n * adapter for the `sdkPackage` its runtime contract declares.\n *\n * This is a FRAMEWORK gap rather than an application misconfiguration — the only one of these\n * reasons the operator cannot fix by editing config — and it exists so that state is stated.\n * Until this reason existed, that configuration silently received Stripe's adapter built over\n * the other provider's secret, because the resolution narrowed on the protocol `kind` and then\n * constructed one named class. `detail` carries the unserved `sdkPackage`.\n */\n NO_ADAPTER_FOR_SDK_PACKAGE = 'no-adapter-for-sdk-package',\n /** An unexpected error was thrown while resolving (registry/SDK fault). */\n RESOLUTION_ERROR = 'resolution-error',\n}\n/** @wildo_source:part:end saas.backend.billing.resolution-failure-reasons */\n\n/**\n * Discriminated result of {@link StartApplicationBackendService.resolveBillingProvider}.\n * A `null` provider always carries a `reason` (and optional `detail`) so the\n * caller can build a surface-specific error instead of a generic one.\n */\n/**\n * Outcome of {@link StartApplicationBackendService.resolveBillingProvider}.\n *\n * `resolved` is an explicit literal discriminant on purpose: the earlier shape discriminated on\n * `provider: null`, which does not narrow the union in every compiler configuration, so the\n * success-only `providerRef` — the ref every billing row is stamped with (#327) — was unreachable\n * after the failure guard.\n */\ntype BillingProviderResolution =\n | { resolved: true; provider: StandardBilling_Interface; providerRef: string }\n | { resolved: false; reason: BillingProviderResolutionFailureReason; detail?: string };\n\n/**\n * Build the fatal startup message for a failed billing-provider resolution,\n * routed by {@link BillingProviderResolutionFailureReason} to the SPECIFIC\n * config surface the operator must fix. Historically this was a single\n * catch-all (\"set providerRef + its secret\"), which misdirected operators\n * whenever the real gap was backend-scope authoring (providerRef + secret\n * both present, provider simply not exposed to the backend runtime).\n *\n * Every branch names the file/field to edit and the follow-up command\n * (`wildo config sync`) so the message is actionable without reading source.\n */\nfunction describeBillingProviderResolutionFailure(\n reason: BillingProviderResolutionFailureReason,\n billingConfig: BillingConfiguration,\n detail?: string,\n): string {\n const providerRef = billingConfig.providerRef ?? '(unset)';\n const prefix = 'billing.enabled is true but the billing provider could not be resolved.';\n const disableHint = 'Alternatively set billing.enabled=false to run without billing.';\n\n switch (reason) {\n case BillingProviderResolutionFailureReason.PROVIDER_REF_UNSET:\n return `${prefix} billing.providerRef is unset — set it (e.g. 'stripe') in your `\n + `backend app config (saas-config.backend.ts → billing.providerRef). ${disableHint}`;\n\n case BillingProviderResolutionFailureReason.PROVIDER_NOT_REACHABLE_ON_BACKEND:\n return `${prefix} providerRef='${providerRef}' is set, but that provider is not exposed `\n + `to the BACKEND runtime, so no billing runtime contract could be loaded. A common `\n + `cause is authoring the provider only in a frontend scope. Fix: author '${providerRef}' `\n + `under providers.scopes.backend in wildo.saas.config.ts (providerCapabilities ['BILLING'], `\n + `protocols ['BILLING_PROVIDER', 'WEBHOOK_ORIGINATOR']), then re-run `\n + `\\`wildo config sync\\` to regenerate the provider runtime artifact. An engine-shipped `\n + `or package-shipped provider needs no hand-authored contribution — discovery reads the `\n + `provider package's own companion barrel and derives the backend target from that scope. `\n + `${disableHint}`;\n\n case BillingProviderResolutionFailureReason.PROVIDER_DISABLED:\n return `${prefix} providerRef='${providerRef}' resolves but is disabled by external-provider `\n + `configuration for the BILLING protocol. Enable it for this environment, then re-run `\n + `\\`wildo config sync\\`. ${disableHint}`;\n\n case BillingProviderResolutionFailureReason.SECRET_MISSING:\n return `${prefix} providerRef='${providerRef}' resolves but its secret `\n + `(env var '${detail ?? 'UNKNOWN'}') is missing. Populate it in your per-env secrets `\n + `(providerEnv) and re-run \\`wildo config sync\\` so it lands in the backend .env. ${disableHint}`;\n\n case BillingProviderResolutionFailureReason.NO_ADAPTER_FOR_SDK_PACKAGE:\n return `${prefix} providerRef='${providerRef}' is reachable, enabled and holds its secret, but `\n + `it declares sdkPackage='${detail ?? 'UNKNOWN'}' and this engine ships no billing adapter `\n + `for it (adapters available: ${listSupportedBillingSdkPackages().join(', ') || 'none'}). `\n + `This is a FRAMEWORK gap, not a config error: no edit to wildo.saas.config.ts can fix it. `\n + `Either point billing.providerRef at a provider whose sdkPackage is served, or add the `\n + `adapter to the engine's billing adapter registry `\n + `(billing/services/billing-adapter-registry.backend.ts). ${disableHint}`;\n\n case BillingProviderResolutionFailureReason.RESOLUTION_ERROR:\n return `${prefix} providerRef='${providerRef}' threw while resolving`\n + `${detail ? `: ${detail}` : ''}. Inspect the backend provider registry / billing SDK `\n + `wiring. ${disableHint}`;\n\n default: {\n // Exhaustiveness guard: adding a new reason without a message\n // branch fails the type-check here rather than shipping a blank\n // fatal at runtime.\n const _exhaustive: never = reason;\n return `${prefix} providerRef='${providerRef}' (${String(_exhaustive)}). ${disableHint}`;\n }\n }\n}\n\n@injectable()\nexport class StartApplicationBackendService {\n /**\n * The profile this runtime booted under. Defaults FAIL-SAFE to `APPLICATION_BACKEND` — the\n * profile that asserts and reports the most — so a host that never declares one is never\n * silently exempted from a check it should run.\n */\n private resolvedRuntimeProfile: ApplicationRuntimeProfile = ApplicationRuntimeProfile.APPLICATION_BACKEND;\n\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n protected isInitialized = false;\n private isPlatformMode = false;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) protected readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) protected readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ApplicationStartupConfigValidatorService) protected readonly applicationStartupConfigValidator: ApplicationStartupConfigValidatorService,\n @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) protected readonly resourcesRegistryService: ResourcesRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) protected readonly repositoriesRegistryService: RepositoriesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) protected servicesRegistryService: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.ControllersRegistryHandlerService) protected readonly controllersRegistryService: ControllersRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.HttpServerService) protected readonly httpServerService: HttpServerBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) protected readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) protected readonly errorHandler: ErrorHandlerService,\n @inject(SAAS_SERVICE_TYPES.AuthorizationsService) protected readonly authorizationsService: AuthorizationsBackendService,\n @inject(SAAS_SERVICE_TYPES.BatchesCronjobsExecutorService) protected readonly batchesExecutor: BatchesCronjobsExecutor_BackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) protected readonly executionContextCreatorBackendService: ExecutionContextCreatorBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourceOperationCustomImplementationRegistryService) protected readonly customImplRegistry: ResourceOperationCustomImplementationRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.MongoDBService) protected readonly mongoDBService: MongoDBService,\n @inject(SAAS_SERVICE_TYPES.RedisService) protected readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.I18nService) protected readonly i18nService: I18nBackendService,\n @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) protected readonly backendProviderRegistryService: BackendProviderRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) protected readonly externalProvidersRegistryService: ExternalProvidersRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.FeatureDefinitionRegistryService) protected readonly featureDefinitionRegistryService: FeatureDefinitionRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.MilestoneDefinitionRegistry) protected readonly milestoneDefinitionRegistry: MilestoneDefinitionRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.MilestoneConditionRegistry) protected readonly milestoneConditionRegistry: MilestoneConditionRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ValueMomentHandlerRegistry) protected readonly valueMomentHandlerRegistry: ValueMomentHandlerRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ValueMomentDefinitionRegistry) protected readonly valueMomentDefinitionRegistry: ValueMomentDefinitionRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.LifecycleEvaluator) protected readonly lifecycleEvaluator: LifecycleEvaluatorBackendService,\n @inject(SAAS_SERVICE_TYPES.FlowsActorsRegistryService) protected readonly flowsActorsRegistryService: FlowsActorsRegistryService,\n @inject(SAAS_SERVICE_TYPES.ResourceServerInstancesRegistry) protected readonly resourceServerInstancesRegistry: ResourceServerInstancesRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.QueueWorkerInitializerService) protected readonly queueWorkerInitializer: QueueWorkerInitializerBackendService,\n @inject(SAAS_SERVICE_TYPES.CronJobSyncService) protected readonly cronJobSyncService: CronJobSyncBackendService,\n @inject(SAAS_SERVICE_TYPES.ChartRegistryService) protected readonly chartRegistryService: ChartRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.GuidanceTriggerEvaluator) protected readonly guidanceTriggerEvaluator: GuidanceTriggerEvaluatorBackendService,\n @inject(SAAS_SERVICE_TYPES.EmailTemplateRegistry) protected readonly emailTemplateRegistryService: EmailTemplateRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.PdfTemplateBinding) protected readonly pdfTemplateBindingService: PdfTemplateBindingBackendService,\n @inject(SAAS_SERVICE_TYPES.FileStorageRouter) protected readonly fileStorageRouter: FileStorageRouterBackendService,\n // Phase 2.F — data-seeding subsystem. Registry stays inert until\n // Step 5.9 calls `registerSeeds(config.dataSeeds ?? [])` and wires the\n // Level-B hooks / lazy-access guards; the dispatcher runs the\n // application-lifecycle passes at Step 7.7 (and from those hooks later).\n @inject(SAAS_SERVICE_TYPES.DataSeedRegistry) protected readonly dataSeedRegistryService: DataSeedRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.DataSeedDispatcher) protected readonly dataSeedDispatcherService: DataSeedDispatcherBackendService,\n @inject(SAAS_SERVICE_TYPES.ApplicationIdentityService) protected readonly applicationIdentityService: ApplicationIdentityBackendService,\n // Phase 7 / Item 47 (Slice 3) — cron CUSTOM_RESOLVER registry. Same\n // boot lifecycle as `dataSeedRegistryService`: hydrated once in Step\n // 7.7 from `ApplicationInitializationConfig.dataSeedScopeResolvers`.\n @inject(SAAS_SERVICE_TYPES.DataSeedScopeResolverRegistry) protected readonly dataSeedScopeResolverRegistryService: DataSeedScopeResolverRegistryBackendService,\n // Slice 2 Phase 4 — observability reconcile + graceful-flush wiring. Appended LAST on\n // PURPOSE: `StartApplicationBackendService` has platform subclasses with FORWARDING\n // constructors that spread a positional `super([...])` array (see\n // `start-application.apps-manager.platform.service.ts` and `...registry.platform.service.ts`).\n // Inserting a param mid-list shifts every later arg and mis-injects them — it crashed the\n // apps-manager with \"featureDefinitionRegistryService.registerCoreFeatures is not a function\".\n // Appending keeps those subclasses aligned (they don't forward this last arg → it is\n // `undefined` there, which is HARMLESS because the reconcile call is gated on\n // `!isPlatformApplication`). Wonder-todos uses this class directly, so Inversify injects it\n // by symbol regardless of position. Optional type + `?.` call site reflect the platform case.\n @inject(SAAS_SERVICE_TYPES.ObservabilityBackendService) protected readonly observabilityBackendService?: ObservabilityBackendService,\n // APPENDED for the same subclass-forwarding reason as `observabilityBackendService` above:\n // subclasses that do not forward this arg receive `undefined`, which is harmless here — the\n // super-administrator floor REPORT degrades to a log-only finding when no audit sink is\n // bound, and the report is non-fatal by design either way.\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional() protected readonly auditLogsService?: AuditLogsBackendService,\n // Appended LAST (platform-subclass forwarding, as above). The organization-owner floor REPORT\n // builds its own whole-estate measuring context from this factory; a platform subclass that does\n // not forward it receives `undefined`, which is harmless — `reportOrganizationOwnerFloor` skips\n // when it is absent, and platform mode runs no tenant population anyway.\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) @optional()\n protected readonly authExecutionContextFactory?: AuthExecutionContextFactoryBackendService,\n // Appended LAST again, for the same subclass-forwarding reason (#1054). A subclass that does\n // not forward it receives `undefined`, which is harmless: `reportApplicationOwnerOrganization`\n // skips when it is absent, and platform mode — the only caller that subclasses this — declares\n // no owner organization type at all.\n @inject(SAAS_SERVICE_TYPES.ApplicationOwnerOrganizationResolver) @optional()\n protected readonly applicationOwnerOrganizationResolver?: ApplicationOwnerOrganizationResolverBackendService,\n // Appended LAST once more, same reason (#1055). A platform subclass that does not forward it\n // receives `undefined`, which is harmless: the initialisation below skips, and no platform\n // service declares a system of record.\n @inject(SYSTEMS_OF_RECORD_REGISTRY_SERVICE_TYPE) @optional()\n private readonly systemsOfRecordRegistry?: SystemsOfRecordRegistryBackendService,\n // APPENDED LAST, optional (#1645), for the platform-subclass forwarding reason above: a subclass that\n // does not forward it receives `undefined`, which is harmless — no platform service declares a PDF\n // collection export, so there is nothing to initialize there.\n @inject(SAAS_SERVICE_TYPES.PdfCollectionExportTemplates) @optional() protected readonly pdfCollectionExportTemplateService?: PdfCollectionExportTemplateBackendService,\n ) {\n this.logger = logger;\n this.appConfigService = appConfigService;\n this.resourcesRegistryService = resourcesRegistryService;\n this.repositoriesRegistryService = repositoriesRegistryService;\n this.servicesRegistryService = servicesRegistryService;\n this.controllersRegistryService = controllersRegistryService;\n this.httpServerService = httpServerService;\n this.authorizationsService = authorizationsService;\n\n this.logDebug = this.logger.debugByType('StartApplicationBackendService');\n this.logger.setDebugTypeLogging('StartApplicationBackendService', false);\n\n this.logDebug('Start application service created');\n }\n\n /**\n * Initialize the backend application with a structured configuration object.\n */\n public async initialize(config: ApplicationInitializationConfig): Promise<void> {\n\n if (this.isInitialized) {\n this.logDebug('Application already initialized, skipping');\n return;\n }\n\n const {\n sharedResourceConfigurations,\n sharedResourceFieldIdentifiers,\n sharedResourceRelationships,\n backendResourceConfigurations,\n backendResourceFieldIdentifiers,\n backendResourceRelationships = [],\n notificationBadgeDefinitions,\n organizationUnitNarrowing,\n serviceProviderOrganizationWideAccess,\n resourceServerInstances,\n customServiceImplementations,\n customRoles,\n customControllers,\n container,\n controllerWhiteList,\n isPlatformApplication = false,\n platformPersistenceAdapter,\n customBatchesFactory,\n flowsActorsRegistry,\n customLabels,\n backendProviderRegistry,\n customFeatureDefinitions,\n customFeatureConfiguration,\n chartDefinitions,\n customMilestoneDefinitions,\n valueMomentHandlers,\n customMilestoneConditions,\n productDefinitions,\n emailTemplateDefinitions,\n providerRuntime,\n pdfTemplateBindings,\n pdfCollectionExportTemplates,\n backendConfig,\n guidanceFlowDefinitions,\n dataSeeds,\n dataSeedScopeResolvers,\n inboundHandlers = [],\n runtimeProfile = ApplicationRuntimeProfile.APPLICATION_BACKEND,\n headlessMode = false,\n skipCronSync = false,\n skipJobConsumers = false,\n servicesRegistryDecoratorFactory,\n afterResourcesRegistryInitialized,\n } = config;\n\n // Resolved ONCE, here, so every gated validator below reads the same\n // decision. Resolving per-call-site would let two validators disagree\n // about the runtime they are validating.\n const bootAssertions = resolveApplicationRuntimeProfileBootAssertions(runtimeProfile);\n /**\n * Kept on the instance so LATER boot steps can consult the same profile this method resolved.\n * Boot steps run as separate methods, and one that has to re-derive the profile is one that\n * can derive it differently — the assertions exist precisely so every step reads one answer.\n */\n this.resolvedRuntimeProfile = runtimeProfile;\n\n try {\n this.logDebug('🚀 Starting backend application initialization...');\n // Step 1: Initialize application configuration\n this.logDebug('📋 Initializing application configuration...');\n\n // Persist platform mode for validation differences\n this.isPlatformMode = !!isPlatformApplication;\n\n if(!isPlatformApplication) {\n await this.appConfigService.initialize();\n if (providerRuntime) {\n this.appConfigService.applyProviderRuntime(providerRuntime);\n }\n this.appConfigService.applyBackendConfig(backendConfig ?? {});\n if (backendConfig) {\n this.logger.info('Backend config applied', {\n sections: Object.keys(backendConfig),\n });\n }\n this.appConfigService.assertNoPreOverridePlaceholders();\n this.logDebug('✅ Application configuration initialized successfully');\n\n /*\n * ANNOUNCE the abuse-throttle relaxation, loudly (#499).\n *\n * In DEVELOPMENT / TEST every abuse-throttle maximum is multiplied by a thousand, decided\n * from the resolved environment alone. That keeps one source of truth for \"what kind of\n * host is this\" instead of a second flag that can disagree with it — the deliberate\n * choice — and it means a host which merely REPORTS development runs with effectively no\n * abuse ceilings. Until now nothing said so at any volume.\n *\n * At `warn` rather than `info`, and naming the sites rather than saying \"abuse limits\n * relaxed\": an operator reading the vague form would reasonably assume ALL throttles, and\n * product-policy counters and audit de-duplication windows are deliberately untouched.\n * Silent in STAGING / PRODUCTION, where the descriptor returns null.\n */\n const throttleRelaxation = describeAbuseThrottleRelaxation(this.appConfigService.applicationEnv);\n if (throttleRelaxation) {\n this.logger.warn(\n `⚠️ ABUSE THROTTLES RELAXED ×${throttleRelaxation.multiplier} — this host reports `\n + `environment \"${throttleRelaxation.applicationEnv}\", so the ceilings below are effectively absent. `\n + `Relaxed: ${throttleRelaxation.relaxedSites.join(', ')}. `\n + 'Product-policy counters and audit de-duplication windows are NOT relaxed.',\n { applicationEnv: throttleRelaxation.applicationEnv, multiplier: throttleRelaxation.multiplier, relaxedSites: throttleRelaxation.relaxedSites },\n );\n }\n /**\n * Establish the default MongoDB connection — ONLY when this application has a\n * MongoDB to connect to.\n *\n * The loader builds `database.mongodb` only when the environment supplies\n * `MONGODB_HOST`, so its ABSENCE is the application saying it has no MongoDB. Until\n * 2026-08-28 this connect was unconditional and rethrowing, which made a mongod a\n * hard boot requirement for every application — including one whose every resource\n * is on PostgreSQL.\n *\n * Contrast the two blocks immediately below: Redis degrades to in-memory with a\n * warning, and file storage is explicitly non-fatal. MongoDB was the only backing\n * service that could refuse a boot by being absent rather than by being broken.\n *\n * It stays FATAL when a MongoDB IS declared and the connection fails — that is a\n * real outage and must not be softened into a warning.\n *\n * ## The gate is the SELECTION, not the address (2026-09-19)\n *\n * This read `config.database?.mongodb` — the branch the loader builds from\n * `MONGODB_HOST` alone. That is an ADDRESS, and an environment legitimately hosts a\n * mongod for OTHER applications: `wonder-todos` is PostgreSQL on both planes, keeps\n * its RAG corpus in pgvector, has never written a document, and still opened this\n * connection at every boot and kept it alive on a 30s timer.\n *\n * PostgreSQL never had this problem — its address is emitted the same way and\n * nothing connects unless `defaultAdapter` selects it. MongoDB now asks the same\n * question. A resource PINNED to MongoDB on a PostgreSQL-default application is\n * unaffected: the address is still in config, so its repository connects on demand\n * through `ensureConnection()` when the registry builds it — which is later than\n * this line, and is the reason the registry cannot be consulted here.\n */\n if (mongoDbIsSelectedStore(this.appConfigService.config.database)) {\n try {\n await this.mongoDBService.connect();\n this.logDebug('✅ MongoDB default connection established');\n } catch (e) {\n this.logger.error('❌ MongoDB default connection failed', e as any);\n throw e;\n }\n } else {\n this.logDebug('↷ No MongoDB configured for this application — skipping the default connection.');\n }\n // Establish Redis connection for caching, sessions, and WebSocket sync\n // Redis is optional - graceful fallback to in-memory if unavailable\n try {\n await this.redisService.connect();\n this.logDebug('✅ Redis connection established');\n } catch (e) {\n this.logger.warn('⚠️ Redis connection failed, using in-memory fallbacks', { ...projectCaughtErrorLogFields(e) });\n }\n\n // Initialize file storage (MinIO/S3) — optional, skipped when not configured\n if (this.fileStorageRouter.isConfigured()) {\n try {\n await this.fileStorageRouter.initialize();\n this.logDebug('✅ File storage initialized');\n } catch (e) {\n // Non-fatal AND not final. An application backend fetches short-lived storage\n // credentials from apps-manager, so a backend that boots BEFORE its issuer is\n // listening fails here with ECONNREFUSED through no fault of its own — an\n // ordinary outcome of concurrent respawn.\n //\n // `WildoManagedStorageProvider.healthCheck()` retries acquisition on every\n // readiness probe, so this clears WITHOUT a restart once the issuer is up\n // (proven live on a platform service 2026-08-13: same PID, monotonic uptime,\n // unhealthy → healthy). The previous wording — \"file operations will fail at\n // runtime\" — described the behaviour before that recovery existed, and now\n // sends whoever greps this log hunting a defect that will have fixed itself.\n this.logger.warn('⚠️ File storage initialization failed at startup — will retry on each readiness probe', { ...projectCaughtErrorLogFields(e) });\n }\n } else {\n this.logDebug('📦 File storage not configured, skipping initialization');\n }\n }\n\n // This is the only application-config read allowed before the\n // platform subclass hydrates AppConfigurationService. The helper\n // branches before evaluating the throwing getter, then every\n // startup decision below consumes this resolved boundary value.\n const applicationConfig = resolveApplicationConfigForStartup(this.appConfigService, isPlatformApplication);\n\n if (applicationConfig) {\n // `!headlessMode` is the auth-SERVING runtime, the same line Step 8.5 draws below.\n this.applicationStartupConfigValidator.validate(applicationConfig, { servesAuthentication: !headlessMode });\n }\n\n /*\n * Step 1.4: the systems of record this application declared (#1055 E9, R8).\n *\n * HERE — after the configuration validator, before resource registration — and the window is\n * narrow for a measured reason. Registration is where a resource's `httpApiBinding` is\n * checked against the instance it names, so the registry must already hold the declarations\n * by then. It must NOT be later still: the providers registry initialises after\n * registration, and #1054's owner-organization resolver needs the repositories registry,\n * later again. Resolving the owner eagerly here would deadlock the two, which is why it is\n * deliberately LAZY and why this step reads only the declaration and the facet map.\n *\n * It never dials a remote. An ERP outage must not stop an application booting.\n */\n /*\n * ONLY on the application BACKEND (#1055 D2, E8) — and this gate was MISSING, which a\n * running stack found before any test did.\n *\n * D2 says the instance's address and credential reach the backend runtime and nothing\n * else, and the env builder implements that: a minion's `.env` carries no `WILDO_SOR_*`\n * at all. What was not implemented is the other half — this registry ran on a MINION too,\n * looked for the values D2 had just withheld from it, and refused. The minion died at boot\n * over a system of record it has no lane to read.\n *\n * The invariant was applied at the delivery site and not at the site that CONSUMES the\n * delivery, which is `invariant-call-site-enumeration.md`'s whole subject. On any other\n * runtime the registry stays empty, and the registration arm skips its instance checks\n * for exactly that reason.\n */\n if (this.systemsOfRecordRegistry && this.resolvedRuntimeProfile === ApplicationRuntimeProfile.APPLICATION_BACKEND) {\n /*\n * The facet resolver is built HERE rather than imported as a function, because it\n * needs the artifact this process was generated with: `systemOfRecordFacetModules`\n * is what makes a PACKAGE-shipped facet reachable (#1057), and the engine ships\n * none any more.\n *\n * An application with no artifact — or one generated before that field existed —\n * gets an empty list and resolves nothing. When it DECLARES systems of record, that\n * is refused right here, naming the stale artifact: letting it fall through produced\n * `SYSTEM_OF_RECORD_VENDOR_HAS_NO_FACET` (\"misspelled, or the package is not\n * installed\") for a vendor that was spelled right and installed — the only thing\n * wrong was an artifact from before the field (measured 2026-09-24, Wonder Todos,\n * after providers-hardening landed). A PRESENT but empty list is a current artifact\n * whose packages ship no facet, and the registry's own refusal is the right one.\n */\n const declaredSystems = Object.keys(applicationConfig?.systemsOfRecord ?? {});\n if (declaredSystems.length > 0 && providerRuntime?.systemOfRecordFacetModules === undefined) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n code: SystemOfRecordErrorCode.FACET_MODULES_NOT_GENERATED,\n systems: declaredSystems,\n message: `This application declares systems of record (${declaredSystems.join(', ')}), but its provider `\n + 'runtime artifact lists no facet modules — it was generated before systems of record existed, or '\n + 'not at all, so no vendor facet can be found. Regenerate it: `wildo config sync --domain=env-files` '\n + '(or `wildo dev start`) in the application, then restart the backend.',\n },\n });\n }\n await this.systemsOfRecordRegistry.initialize(\n applicationConfig?.systemsOfRecord,\n createSystemOfRecordFacetResolver({\n facetModules: providerRuntime?.systemOfRecordFacetModules,\n }),\n undefined,\n undefined,\n /*\n * #1057 R5 — consulted only when a vendor has no facet, to say WHICH vendor\n * carries it. The same modules as the facet resolver above, because an alias and\n * the facet it points at are declared by the same catalogue.\n */\n createSystemOfRecordVendorAliasResolver({\n facetModules: providerRuntime?.systemOfRecordFacetModules,\n }),\n );\n }\n\n // Step 1.5: Initialize roles configuration\n this.logDebug('🔐 Initializing roles configuration...');\n if (customRoles) {\n this.authorizationsService.initializeRolesWithCustom(customRoles);\n this.logDebug('✅ Roles configuration initialized with custom roles');\n } else {\n // Roles are already initialized with defaults in the constructor\n this.logDebug('✅ Roles configuration using default roles only');\n }\n\n // Service-provider declarations (#1597), checked against the LIVE role table built one step\n // above — the first moment it exists. Fail closed: a provider role that reaches ORG_ADMIN would\n // hand every expert of every firm administration of every client; a role unavailable in a\n // client type would make every acceptance refuse at runtime. Neither may boot.\n const serviceProviderViolations = collectServiceProviderDeclarationViolations({\n organizationTypes: (this.appConfigService.isInitialized() ? this.appConfigService.config.organizationTypes : undefined) as never,\n administrationAnchorRole: CORE_ORG_ROLES.ORG_ADMIN,\n organizationRoleHierarchy: (role) => this.authorizationsService.getRoleHierarchy(role as never, ResourcePrimaryScope.ORGANIZATIONS),\n });\n if (serviceProviderViolations.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n reason: 'service_provider_declaration_violation',\n violations: serviceProviderViolations,\n message: 'An organization type\\'s `servesAsProvider` declares a role that reaches ORG_ADMIN, is undeclared, '\n + 'is unavailable in a client type, or is a delegated capability role (ORG_DELEGATED_*, lent only by a '\n + 'dated grant). Fix `organizationTypes` in wildo.saas.config.ts and run '\n + '`wildo config reapply-declaration`.',\n },\n });\n }\n\n // Expert-approval deadlines (#1909): a client type's `acceptsServiceProviders.expertApprovalDeadlines` is\n // #1628's declaration on a plane that offers only an answer, so a claim, a reassignment or a pause state could\n // never do what it says — refused rather than half-honoured, like every other deadline declaration.\n {\n const configuredTypes = (this.appConfigService.isInitialized() ? this.appConfigService.config.organizationTypes : undefined) ?? {};\n const calendarDeclared = this.appConfigService.isInitialized() && !!this.appConfigService.config.reviewCalendar;\n const expertApprovalDeadlineIssues = Object.entries(configuredTypes).flatMap(([organizationType, definition]) =>\n serviceProviderExpertApprovalDeadlinesIssues(\n (definition as { acceptsServiceProviders?: { expertApprovalDeadlines?: ReviewDeadlinesDeclaration } } | undefined)?.acceptsServiceProviders?.expertApprovalDeadlines,\n { calendarDeclared },\n ).map((issue) => `${organizationType}: ${issue}`));\n if (expertApprovalDeadlineIssues.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n reason: 'service_provider_expert_approval_deadlines_invalid',\n issues: expertApprovalDeadlineIssues,\n message: 'An organization type\\'s `acceptsServiceProviders.expertApprovalDeadlines` asks for something an expert approval '\n + 'cannot do. Fix `organizationTypes` in wildo.saas.config.ts.',\n },\n });\n }\n }\n\n // Delegated capability roles (#1631), against the same LIVE table: an application may redefine a role, and a\n // capability role that inherits toward ORG_ADMIN / ORG_OWNER would turn a narrow, time-bound delegation into\n // administration of the client. Nor may one be missing — a grant of it would confer nothing, silently.\n const capabilityRoleViolations = collectDelegatedCapabilityRoleViolations({\n organizationRoleHierarchy: (role) => this.authorizationsService.getRoleHierarchy(role as never, ResourcePrimaryScope.ORGANIZATIONS),\n administrationAnchorRoles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_OWNER],\n organizationRoles: Object.keys(this.authorizationsService.getOrgRoles() ?? {}),\n });\n if (capabilityRoleViolations.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n reason: 'delegated_capability_role_violation',\n violations: capabilityRoleViolations,\n message: 'A delegated administrative capability role (ORG_DELEGATED_*) is missing from the organization role table, '\n + 'inherits toward ORG_ADMIN / ORG_OWNER, or is inherited by another role. A capability must confer exactly the '\n + 'operations that name it, and only through a live grant.',\n },\n });\n }\n\n /*\n * The role expansion the resources registry needs to check a PARTITIONED system of\n * record's reach (#1058 R1). Wired HERE because this is the first moment both exist:\n * roles were initialised one step above, and the registry runs one step below.\n *\n * A setter rather than a constructor dependency — `AuthorizationsBackendService` already\n * depends on the registry, so injecting it back would close a cycle — and rather than a\n * tenth positional parameter on `initialize`, which under `strict: false` is a position a\n * caller can get wrong silently (#1250).\n */\n this.resourcesRegistryService.useRoleHierarchyResolver(\n (role, scope) => this.authorizationsService.getRoleHierarchy(role as never, scope),\n );\n\n // Step 2: Initialize resources registry with all 4 sources\n this.logDebug('🔧 Initializing resources registry...');\n\n // Read lifecycle config early — needed for both resource exclusion and evaluator init\n // Platform apps don't use lifecycle, billing, or feature gating\n const lifecycleConfig: LifecycleConfig | undefined = applicationConfig?.lifecycle;\n\n // Compute excluded resource types based on app configuration.\n // When billing/lifecycle is disabled, their resource types are excluded\n // from the registry (no routes, no repositories, no frontend resources).\n // When billing IS enabled, scope variants for scopes not in enabledScopes\n // are also excluded (e.g., USER variants when only ORG billing is enabled).\n const excludedResourceTypes = resolveFeatureGatedCoreResourceExclusions(\n applicationConfig,\n { isPlatformApplication },\n );\n\n if (excludedResourceTypes) {\n this.logDebug(`Feature-gated resources excluded: ${excludedResourceTypes.size} types`, {\n billingDisabled: !applicationConfig?.billing?.enabled,\n billingDisabledScopes: (() => {\n const billingConfig = applicationConfig?.billing;\n if (!billingConfig?.enabled) return 'all';\n const enabledSet = new Set<string>(billingConfig.enabledScopes ?? []);\n return BILLING_SCOPES.filter(s => !enabledSet.has(s));\n })(),\n lifecycleDisabled: !lifecycleConfig?.enabled,\n });\n }\n\n await this.resourcesRegistryService.initialize(\n sharedResourceConfigurations,\n sharedResourceFieldIdentifiers,\n sharedResourceRelationships,\n (backendResourceConfigurations ?? {}) as ResourceConfiguration_InitializationFactoryMap,\n backendResourceFieldIdentifiers,\n backendResourceRelationships,\n notificationBadgeDefinitions,\n undefined, // customAdditionalUserNotificationDefinitions\n excludedResourceTypes,\n organizationUnitNarrowing,\n serviceProviderOrganizationWideAccess,\n );\n this.logDebug('✅ Resources registry initialized successfully');\n if (applicationConfig && afterResourcesRegistryInitialized) {\n await afterResourcesRegistryInitialized({\n appConfig: applicationConfig,\n resourcesRegistryService: this.resourcesRegistryService,\n errorBuilder: this.errorBuilder,\n });\n this.logDebug('✅ Runtime-specific resource-catalog hook completed');\n }\n\n this.pdfTemplateBindingService.initialize(pdfTemplateBindings ?? {}, {\n assertCompleteness: bootAssertions.assertsGeneratedPdfBindingCompleteness,\n });\n this.logDebug('✅ PDF template bindings initialized successfully');\n this.pdfCollectionExportTemplateService?.initialize(pdfCollectionExportTemplates ?? [], {\n assertCompleteness: bootAssertions.assertsGeneratedPdfBindingCompleteness,\n });\n\n // Step 2.0.1: Initialize feature definition registry\n this.logDebug('🏷️ Initializing feature definition registry...');\n this.featureDefinitionRegistryService.registerCoreFeatures();\n if (customFeatureDefinitions && customFeatureDefinitions.length > 0) {\n this.featureDefinitionRegistryService.registerCustomFeatures(customFeatureDefinitions);\n }\n this.featureDefinitionRegistryService.validateDefinitions();\n this.featureDefinitionRegistryService.logStartupSummary();\n\n // Build and set the merged FeatureConfiguration (profiles + policy)\n if (customFeatureConfiguration) {\n const allDefinitions = this.featureDefinitionRegistryService.getAllDefinitions();\n this.featureDefinitionRegistryService.setConfiguration({\n definitions: allDefinitions,\n profiles: customFeatureConfiguration.profiles ?? {},\n defaultProfile: customFeatureConfiguration.defaultProfile,\n unavailabilityPolicy: {\n defaultBehavior: customFeatureConfiguration.unavailabilityPolicy?.defaultBehavior ?? FeatureUnavailabilityBehavior.UPGRADE_PROMPT,\n whenBillingDisabled: customFeatureConfiguration.unavailabilityPolicy?.whenBillingDisabled ?? FeatureUnavailabilityBehavior.HIDE,\n roleDefaults: customFeatureConfiguration.unavailabilityPolicy?.roleDefaults ?? {},\n reasonDefaults: customFeatureConfiguration.unavailabilityPolicy?.reasonDefaults ?? {\n [FeatureUnavailabilityReason.FEATURE_NOT_ENABLED]: FeatureUnavailabilityBehavior.UPGRADE_PROMPT,\n [FeatureUnavailabilityReason.LIMIT_EXCEEDED]: FeatureUnavailabilityBehavior.LIMIT_UPGRADE_PROMPT,\n [FeatureUnavailabilityReason.NOT_CONFIGURED]: FeatureUnavailabilityBehavior.HIDE,\n },\n },\n });\n this.logDebug('✅ Feature configuration set (profiles + unavailability policy)');\n }\n const analyticsValueMoments = applicationConfig?.analytics?.valueMoments;\n\n this.featureDefinitionRegistryService.warnMisplacedLimitFeatures();\n this.featureDefinitionRegistryService.warnInvalidFeatureReferences({\n featureProfiles: customFeatureConfiguration?.profiles,\n chartDefinitions,\n guidanceFlowDefinitions,\n productDefinitions,\n analyticsValueMoments,\n referralRewards: [applicationConfig?.billing?.referrals?.referrerReward, applicationConfig?.billing?.referrals?.referredReward],\n });\n this.logDebug('✅ Feature definition registry initialized successfully');\n\n // Step 2.0.2: Initialize milestone definition registry\n this.logDebug('🏅 Initializing milestone definition registry...');\n if (customMilestoneConditions && customMilestoneConditions.length > 0) {\n for (const { ref, fn } of customMilestoneConditions) {\n this.milestoneConditionRegistry.registerCondition(ref, fn);\n }\n this.logDebug(`Registered ${customMilestoneConditions.length} custom milestone condition(s)`);\n }\n if (customMilestoneDefinitions && customMilestoneDefinitions.length > 0) {\n this.milestoneDefinitionRegistry.registerCustomMilestones(customMilestoneDefinitions);\n this.milestoneDefinitionRegistry.validateDefinitions();\n this.milestoneDefinitionRegistry.logStartupSummary();\n }\n this.logDebug('✅ Milestone definition registry initialized successfully');\n\n /*\n * Step 2.0.2b: value moment definitions + their backend handlers.\n *\n * Until #414 `analyticsValueMoments` was read ONCE, a few lines above, purely to warn\n * about invalid feature references — and then discarded. So the engine had nothing to\n * evaluate, and the two `analytics.persistence.*` defaults promised an application\n * cross-device persistence and authoritative evaluation it could not receive.\n *\n * Handlers register BEFORE definitions so a definition naming one is never briefly\n * evaluable against a registry that does not hold it.\n */\n if (valueMomentHandlers && valueMomentHandlers.length > 0) {\n for (const { ref, fn } of valueMomentHandlers) {\n this.valueMomentHandlerRegistry.registerHandler(ref, fn);\n }\n this.logDebug(`Registered ${valueMomentHandlers.length} value moment handler(s)`);\n }\n if (analyticsValueMoments && analyticsValueMoments.length > 0) {\n this.valueMomentDefinitionRegistry.registerDefinitions(analyticsValueMoments);\n this.valueMomentDefinitionRegistry.validateDefinitions();\n this.valueMomentDefinitionRegistry.logStartupSummary();\n }\n\n // Step 2.0.3: Initialize lifecycle evaluator configuration\n /*\n * `evaluatesSubjectLifecycle` as well as the application's own switch: the evaluator\n * runs on every service-tier write and reads/creates the application-wide lifecycle\n * singletons, which a confined runtime neither holds grants over nor owns. Leaving the\n * config unset is what makes it inert — `onOperation` returns immediately without one.\n */\n if (!isPlatformApplication && lifecycleConfig?.enabled && bootAssertions.evaluatesSubjectLifecycle) {\n this.logDebug('🔄 Initializing lifecycle evaluator...');\n this.lifecycleEvaluator.setLifecycleConfig(lifecycleConfig);\n\n // Late-binding initialization for lifecycle custom implementations\n initializeLifecycleCustomImplementations(this.lifecycleEvaluator, lifecycleConfig, this.errorBuilder);\n\n // Validate activation criteria refs against registries\n if (lifecycleConfig.activationCriteria?.criteria) {\n for (const criterion of lifecycleConfig.activationCriteria.criteria) {\n /*\n * A DOT in a criterion ref silently nests the stored key. Each met criterion\n * is recorded as `activationCriteriaMet.${ref}`, a PATH-KEYED mutation both\n * adapters compile as a nested write, while the evaluator reads the FLAT key\n * (`progressionState.milestonesAchieved[criterion.milestoneRef]`). The\n * criterion is written and never reads as met, so activation never completes\n * — silently, because nothing throws.\n */\n const criterionRef = criterion.criterionType === ActivationCriterionType.MILESTONE\n ? criterion.milestoneRef\n : criterion.guidanceFlowRef;\n if (typeof criterionRef === 'string' && criterionRef.includes('.')) {\n this.logger.warn(\n `Lifecycle activation criterion ref '${criterionRef}' contains '.', the mutation path separator — `\n + 'it will be stored nested and can never read as met',\n );\n }\n if (criterion.criterionType === ActivationCriterionType.MILESTONE) {\n /*\n * Only a runtime that RECEIVES milestone definitions may call a ref\n * unknown. A minion's scoped projection carries none, so its registry is\n * empty by construction and every criterion looks unresolvable — the\n * lookup could not ask, which is not the same as an absent milestone\n * (`.claude/rules/negative-results-require-a-positive-probe.md`).\n */\n if (!bootAssertions.assertsLifecycleActivationCriteriaResolvability) {\n this.logDebug(\n `Lifecycle activation criterion '${criterion.milestoneRef}' not checked — `\n + `runtime profile '${runtimeProfile}' carries no milestone definitions`,\n );\n } else if (!this.milestoneDefinitionRegistry.getDefinition(criterion.milestoneRef)) {\n this.logger.warn(`Lifecycle activation criterion references unknown milestone: '${criterion.milestoneRef}'`);\n }\n } else if (criterion.criterionType === ActivationCriterionType.GUIDANCE_COMPLETED) {\n this.logDebug(`Lifecycle activation criterion references guidance flow: '${criterion.guidanceFlowRef}' (validated at runtime)`);\n }\n }\n }\n\n this.logDebug('✅ Lifecycle evaluator configured', {\n dormancyThresholdDays: lifecycleConfig.dormancyThresholdDays,\n activityDebounceMinutes: lifecycleConfig.activityDebounceMinutes,\n dormancyCronSchedule: lifecycleConfig.dormancyCronSchedule,\n activationCriteriaCount: lifecycleConfig.activationCriteria?.criteria?.length ?? 0,\n });\n } else if (!isPlatformApplication) {\n this.logDebug('🔄 Lifecycle system disabled (lifecycle.enabled = false or not configured)');\n }\n\n // Step 2.1: LOAD, then initialize, the first-class backend provider registry.\n //\n // The loader imports EXACTLY the refs `providerRuntime` declares — an\n // application-supplied module first, then the engine's on-demand map, then a\n // dynamic import of the package the artifact names for that ref (#330). Nothing\n // this process did not declare is evaluated, which is what stops a worker that\n // declares one email provider from pulling six model SDKs into its boot graph.\n //\n // `initialize` then re-filters against the same artifact and fails startup loudly\n // for any ref that did not resolve, quoting the loader's reason. Minion and worker\n // startup reach this same step by delegating here with their per-host projected\n // artifact, so all three hosts load identically.\n this.logDebug('📦 Loading backend providers...');\n const resolvedProviders = await resolveBackendProviderRegistry({\n providerRuntime,\n applicationFragment: backendProviderRegistry,\n });\n this.backendProviderRegistryService.initialize(\n resolvedProviders.registry,\n providerRuntime,\n resolvedProviders.unresolved,\n );\n this.logDebug('✅ Backend provider registry initialized', {\n providerRuntimeApplied: Boolean(providerRuntime),\n providerCount: this.backendProviderRegistryService.getRegistry().modules.size,\n });\n\n // Step 2.2: Initialize external providers registry.\n // Skip for platform applications - they initialize config later and will refresh the registry\n if (applicationConfig) {\n this.logDebug('🔌 Initializing external providers registry...');\n await this.externalProvidersRegistryService.initialize();\n this.logDebug('✅ External providers registry initialized successfully');\n\n // F5 (audit Phase 5) + #328 — required-capability floor. Fail LOUD if any capability\n // the app marked `required`, or any ENABLED engine flow slot (email, billing, SMS),\n // resolves no active provider. The door lives on the registry so the platform\n // services run the same check after their own `refreshFromConfig()`; the engine\n // half is profile-gated because a minion's scope-filtered registry serves none of\n // those slots by design.\n this.externalProvidersRegistryService.assertRequiredCapabilityFloor({\n includeEngineFloor: bootAssertions.assertsEngineCapabilityProviderFloor,\n });\n\n // G4 (audit Phase 5) — fail-OPEN audit-sink reconcile. Distinct from the\n // F5 hard guard above: this WARNS (never throws) when COMPLIANCE_AUDIT_TRAIL\n // is ENABLED but no provider resolves to deliver it — the operator turned on\n // Layer-2 audit fan-out yet nothing serves it (Layer-1 database audit is\n // unaffected). Mirrors ObservabilityBackendService's declared-but-inactive\n // reconcile. The resolved-provider-refs check is the faithful proxy for \"the\n // composite resolves zero live sinks\" (it builds one sink per resolved ref).\n // A `required` audit cap with no provider already threw in F5 above, so this\n // only fires for an enabled-but-not-required capability.\n //\n // Gated on the runtime profile: only a runtime EXPECTED to host the Layer-2\n // audit fan-out (the application backend) treats \"enabled but no provider\" as\n // a misconfiguration. An auxiliary runtime such as a minion is Layer-1-only by\n // design — the immudb node client is installed only in the backend, and the\n // backend's `immudb.audit-reconcile` cron backfills the minion's `AUDIT_LOGS`\n // rows into Layer-2 — so warning there is false-alarm noise on every restart,\n // not a real signal. `assertsLayer2AuditProviderPresence` is read off the same\n // `bootAssertions` decision resolved once above, so this gate cannot disagree\n // with the sibling profile-gated validators about which runtime is booting.\n const resolvedAuditProviderRefs = this.externalProvidersRegistryService.getResolvedProviderRefsForCapability(\n EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n );\n const layer2AuditGateInput = {\n runtimeAssertsLayer2AuditProviderPresence: bootAssertions.assertsLayer2AuditProviderPresence,\n complianceAuditTrailEnabled: this.externalProvidersRegistryService.isEngineCapabilityEnabled(\n EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n ),\n resolvedAuditProviderRefCount: resolvedAuditProviderRefs.length,\n };\n // The healthy branch is recorded POSITIVELY (#1413): silence is also what a Layer-1-only\n // runtime and a disabled capability produce, so evidence of an active fan-out must not be\n // inferred from the absence of the warning below.\n if (shouldRecordLayer2AuditFanOutActive(layer2AuditGateInput)) {\n this.logger.info(LAYER2_AUDIT_FAN_OUT_ACTIVE_MESSAGE, { resolvedAuditProviderRefs: [...resolvedAuditProviderRefs].sort() });\n }\n if (shouldWarnLayer2AuditProviderInactive(layer2AuditGateInput)) {\n this.logger.warn(\n 'COMPLIANCE_AUDIT_TRAIL is enabled but no audit-log provider resolves — Layer-2 provider '\n + 'audit fan-out is INACTIVE (Layer-1 database audit is unaffected). Declare an audit provider '\n + '(e.g. immudb) in defineSaaSProviders, or disable the capability if Layer-1 alone is intended.',\n );\n }\n } else {\n this.logDebug('🔌 Skipping external providers registry initialization (platform app - will initialize after config is ready)');\n }\n\n // Step 2.3: Initialize flows-actors registry\n this.logDebug('🎭 Initializing flows-actors registry...');\n const mergedFlowActorSystemsFactoryMap = {\n ...(flowsActorsRegistry?.flowActorSystemsFactoryMap || {}),\n };\n const mergedAgents = [\n ...(flowsActorsRegistry?.agents || []),\n ];\n const mergedFunctionTools = [\n ...(flowsActorsRegistry?.functionTools || []),\n ];\n await this.flowsActorsRegistryService.initialize(\n mergedFlowActorSystemsFactoryMap,\n mergedAgents,\n mergedFunctionTools,\n undefined,\n flowsActorsRegistry?.autonomousAgents ?? [],\n );\n this.logDebug('✅ Flows-actors registry initialized successfully');\n\n // Step 2.3b: Register the app's NAMED external resource-server instances (multiple MCP\n // servers / A2A agents) and validate their membership refs. Runs HERE deliberately — after\n // BOTH the resources registry (Step 2.1, for `operation.mcp.servers`) and the flows-actors\n // registry (Step 2.3, for an agent's `actorSystemRefs`) — because validation resolves refs\n // against them. A bad ref throws a CONFIGURATION error and fails startup (fail-closed):\n // a tool that silently belongs to no catalog, or a card advertising an unroutable skill,\n // is worse than a refusal to boot.\n // Membership validation is gated on the runtime profile: it asserts that every\n // `operation.mcp.servers` / `actorSystemRefs` ref resolves to a declared instance,\n // which is only meaningful for a runtime that actually SERVES those transports.\n // A minion mounts none and carries no declarations, so running this would fail its\n // boot over refs describing a surface it cannot expose — the exact crash-loop that\n // motivated the profile mechanism. Registration itself always runs: an empty\n // registry is the correct state for a non-serving runtime, and `tryGetInstance`\n // callers stay fail-closed against it.\n this.logDebug('🔀 Registering external resource-server instances...');\n this.resourceServerInstancesRegistry.initialize(resourceServerInstances);\n if (bootAssertions.assertsResourceServerMembershipCompleteness) {\n this.resourceServerInstancesRegistry.validateDeclaredMembership(\n this.flowsActorsRegistryService.getActors().map((system) => system.ref),\n this.flowsActorsRegistryService\n .getActors()\n .filter((system) => system.visibility !== FlowActorSystem_Visibility.FRONTEND)\n .map((system) => system.ref),\n );\n this.logDebug('✅ External resource-server instances registered + validated');\n } else {\n this.logDebug('✅ External resource-server instances registered (membership validation N/A for this runtime profile)', {\n runtimeProfile,\n });\n }\n\n // Step 2.4: Initialize I18n service with custom labels\n this.logDebug('🌐 Initializing I18n service...');\n this.i18nService.initialize(customLabels || {}, {\n suppressEmptyWarning: isPlatformApplication,\n });\n this.logDebug('✅ I18n service initialized successfully');\n\n // Step 2.4b: Initialize email template registry\n if (emailTemplateDefinitions && Object.keys(emailTemplateDefinitions).length > 0) {\n this.emailTemplateRegistryService.initialize(emailTemplateDefinitions);\n }\n\n if (!isPlatformApplication) {\n // Reconcile OTLP observability (post-config): compare the `--import` preload's\n // runtime state against the OBSERVABILITY_TELEMETRY provider selection, warn on\n // mismatch (E11), and wire graceful telemetry flush into the shutdown coordinator.\n // `?.` — platform subclasses don't forward this arg (see the constructor note); this\n // branch is non-platform so it's always defined here, but the guard is defensive.\n this.observabilityBackendService?.initialize();\n }\n\n // Step 2.5: Register chart definitions\n if (chartDefinitions && chartDefinitions.length > 0) {\n this.logDebug('📊 Registering chart definitions...', { count: chartDefinitions.length });\n for (const chartDef of chartDefinitions) {\n this.chartRegistryService.registerChart(chartDef);\n }\n this.logDebug('✅ Chart definitions registered successfully', { count: chartDefinitions.length });\n } else {\n this.logDebug('📊 No chart definitions provided, skipping chart registration');\n }\n\n // Step 2.5b: Register guidance flow definitions\n if (guidanceFlowDefinitions && guidanceFlowDefinitions.length > 0) {\n this.logDebug('🧭 Registering guidance flow definitions...', { count: guidanceFlowDefinitions.length });\n this.guidanceTriggerEvaluator.initializeFlows(guidanceFlowDefinitions);\n this.logDebug('✅ Guidance flow definitions registered successfully', { count: guidanceFlowDefinitions.length });\n } else {\n this.logDebug('🧭 No guidance flow definitions provided, skipping guidance registration');\n }\n\n // Step 2.6: Debug URL generation\n this.logDebug('🌐 Displaying generated URLs for debugging...');\n this.resourcesRegistryService.debugDisplayGeneratedUrls();\n\n // Step 3: Initialize repositories registry\n this.logDebug('🗄️ Initializing repositories registry...');\n const resourcesRegistry = this.resourcesRegistryService.getResourcesRegistry();\n\n // Guardrail: a REQUIRED composition-parent FK that the user must supply on\n // org-wide create (the parent is OPTIONAL_CONTEXT/STANDALONE) must be\n // user-fillable — otherwise the create form is silently dead (the\n // todoListId-create class of bug). Surface violations at boot rather than as\n // an unexplained client-side validation failure.\n //\n // Severity split: TARGET_NOT_SEARCHABLE degrades the picker → WARN (a custom\n // create surface might still supply the FK). EXCLUDED_FROM_CREATE is genuinely\n // impossible to create (no context, no control) → FAIL loud so the misconfig\n // never ships. The validator call itself is try/catch-guarded so a validator\n // edge case can never block startup; the intentional FAIL throw is outside\n // that guard so it propagates.\n let fkFillabilityViolations: ForeignKeyFillabilityViolation[] = [];\n try {\n fkFillabilityViolations = validateRequiredForeignKeyFillability(\n resourcesRegistry.resourceConfigurations as any,\n );\n } catch (error) {\n this.logger.warn('⚠️ required-foreign-key fillability guardrail skipped (validation error)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n for (const violation of fkFillabilityViolations) {\n if (violation.severity === ForeignKeyFillabilityViolationSeverity.WARN) {\n this.logger.warn(`⚠️ Required foreign key may be unfillable on create [${violation.kind}]: ${violation.message}`, {\n resourceType: violation.resourceType,\n foreignKeyField: violation.foreignKeyField,\n parentResourceType: violation.parentResourceType,\n kind: violation.kind,\n });\n }\n }\n const fkFillabilityFailures = fkFillabilityViolations.filter(\n (violation) => violation.severity === ForeignKeyFillabilityViolationSeverity.FAIL,\n );\n if (fkFillabilityFailures.length > 0) {\n throw new Error(\n `Resource configuration error — ${fkFillabilityFailures.length} required foreign key(s) are impossible to fill on create:\\n` +\n fkFillabilityFailures.map((failure) => ` • ${failure.message}`).join('\\n'),\n );\n }\n\n // --- Initiator-stamped field guard (#584) ---\n // FAIL-CLOSED: a REQUIRED `createdByUserId` / `updatedByUserId` / `lastUpdatedByUserId` cannot be\n // satisfied by a machine principal — the client may not send it and the repository stamps it only\n // from a userId — so a machine write to that resource fails, or commits and then fails to describe\n // itself. It was a boot REPORT while flipping the existing declarations was believed to owe\n // PostgreSQL migrations; it does not (the planner contract records no nullability), so the\n // declaration is refused here instead of being discovered by the first machine caller. The\n // validator call is try/catch-guarded so a validator edge case can never block startup; the\n // intentional throw is outside that guard. See `validateInitiatorStampedFieldSatisfiability`.\n let initiatorStampedViolations: InitiatorStampedFieldViolation[] = [];\n try {\n initiatorStampedViolations = validateInitiatorStampedFieldSatisfiability(resourcesRegistry.resourceConfigurations as any);\n } catch (error) {\n this.logger.warn('⚠️ initiator-stamped field guard skipped (validation error)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n if (initiatorStampedViolations.length > 0) {\n throw new Error(\n `Resource configuration error — ${initiatorStampedViolations.length} engine-stamped field(s) are REQUIRED and unsatisfiable by a machine principal:\\n` +\n initiatorStampedViolations.map((violation) => ` • ${violation.message}`).join('\\n'),\n );\n }\n\n // --- Composition-seedability guard (onParentCreate lifecycle) ---\n // FAIL-CLOSED: a composition that OPTED IN to `onParentCreate.enabled` but\n // whose child is not seedable (not default-materializable AND no override)\n // is a genuine misconfig — the runtime seed would silently no-op. It fires\n // ONLY on enabled adopters, so it never trips the dozens of on-demand\n // compositions that legitimately do not eager-seed. The validator call is\n // try/catch-guarded so a validator edge case can never block startup; the\n // intentional throw is outside that guard. See\n // .claude/plans/composition-oncreate-lifecycle.md.\n let compositionSeedabilityViolations: CompositionSeedabilityViolation[] = [];\n try {\n compositionSeedabilityViolations = validateCompositionSeedability(\n resourcesRegistry.resourceConfigurations as any,\n );\n } catch (error) {\n this.logger.warn('⚠️ composition-seedability guardrail skipped (validation error)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n for (const violation of compositionSeedabilityViolations) {\n this.logger.warn(`⚠️ [composition-seedability] ${violation.message}`, {\n childResourceType: violation.childResourceType,\n parentResourceType: violation.parentResourceType,\n missingFields: violation.missingFields,\n });\n }\n if (compositionSeedabilityViolations.length > 0) {\n throw new Error(\n `Resource configuration error — ${compositionSeedabilityViolations.length} composition relationship(s) enabled ` +\n `onParentCreate seeding but are not seedable:\\n` +\n compositionSeedabilityViolations.map((violation) => ` • ${violation.message}`).join('\\n'),\n );\n }\n\n // --- Composition cascade-DELETABILITY guard (onParentDelete lifecycle) ---\n // The delete-side counterpart of the seedability guard above. It is wired FAIL-CLOSED for\n // IMPERSONALIZE_AND_RETAIN and REFUSE_WHILE_CHILDREN_EXIST edges, and warn-only for DELETE edges:\n // - DELETE violations stay a warning: an edge that declares a DELETE cascade toward a child\n // missing its discovery or DELETE op needs a per-edge decision (add the op, retain, or drop\n // the cascade), and throwing would fail boot on any registry that has not made it yet. The\n // 16 billing edges once tracked as KNOWN_CASCADE_DELETABILITY_GAPS are resolved: the scope\n // edges are disabled and the billing-account edges declare REFUSE_WHILE_CHILDREN_EXIST.\n // - IMPERSONALIZE_AND_RETAIN violations have NO such backlog (no core edge declares the\n // strategy yet), and their runtime failure mode is far worse: the misconfiguration\n // surfaces only when a real erasure runs, throws INSIDE the parent-delete transaction\n // and rolls the deletion back — i.e. a GDPR erasure request fails in production. Catch\n // it at boot instead.\n // - REFUSE_WHILE_CHILDREN_EXIST violations (a child without READ) have no backlog either\n // (#1123), and at runtime every delete of the parent would fail CONFIGURATION on the\n // existence probe. The fix is one declaration, so boot names it.\n let cascadeDeletabilityViolations: CompositionCascadeDeletabilityViolation[] = [];\n try {\n cascadeDeletabilityViolations = validateCompositionCascadeDeletability(\n resourcesRegistry.resourceConfigurations as any,\n );\n } catch (error) {\n this.logger.warn('⚠️ composition-cascade-deletability guardrail skipped (validation error)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n const fatalCascadeViolations = cascadeDeletabilityViolations.filter(\n (violation) => violation.strategy !== ChildLifecycleStrategy.DELETE,\n );\n const deleteCascadeViolations = cascadeDeletabilityViolations.filter(\n (violation) => violation.strategy === ChildLifecycleStrategy.DELETE,\n );\n // ONE aggregated line for the known DELETE backlog — per-violation warnings would put ~16\n // lines in every boot log and train operators to ignore the channel.\n if (deleteCascadeViolations.length > 0) {\n // Report the EDGES, not a presumed cause. An earlier version asserted \"known backlog —\n // pending a retain-vs-delete compliance decision\", which is true only for the billing\n // families; a live run showed platform resources in the same list, where the cause is\n // simply a missing DELETE op. Stating one registry's story for every registry's\n // violations is how an operator learns to ignore the channel.\n const distinctEdges = [\n ...new Set(deleteCascadeViolations.map((v) => `${v.childResourceType} <- ${v.parentResourceType}`)),\n ];\n this.logger.warn(\n `⚠️ [composition-cascade-deletability] ${distinctEdges.length} onParentDelete edge(s) declare a DELETE ` +\n `cascade toward a child that cannot be cascade-deleted (missing discovery and/or DELETE op). Deleting ` +\n `such a parent throws CONFIGURATION inside its delete transaction and ROLLS BACK the parent delete, ` +\n `once a child row exists. Each edge needs a decision: add the missing op(s), retain the children ` +\n `(disable the cascade, or use strategy IMPERSONALIZE_AND_RETAIN with a retention-governed child), or ` +\n `drop onParentDelete.`,\n {\n edges: distinctEdges,\n // Surfaced because a duplicated pair means the SAME relationship is registered twice\n // for that child — a registry-assembly problem, not a cascade problem.\n duplicatedEdgeReports: deleteCascadeViolations.length - distinctEdges.length,\n },\n );\n }\n for (const violation of fatalCascadeViolations) {\n this.logger.warn(`⚠️ [composition-cascade-deletability] ${violation.message}`, {\n childResourceType: violation.childResourceType,\n parentResourceType: violation.parentResourceType,\n strategy: violation.strategy,\n });\n }\n if (fatalCascadeViolations.length > 0) {\n throw new Error(\n `Resource configuration error — ${fatalCascadeViolations.length} composition relationship(s) declared ` +\n `an onParentDelete strategy their child cannot honour (IMPERSONALIZE_AND_RETAIN or REFUSE_WHILE_CHILDREN_EXIST):\\n` +\n fatalCascadeViolations.map((violation) => ` • ${violation.message}`).join('\\n'),\n );\n }\n\n // --- Dependent-lifecycle CLASSIFICATION report (onParentDelete declared at all?) ---\n // The complement of the two guards above: they judge edges that OPTED IN to a lifecycle;\n // this reports the DEPENDENT edges that never opted either way. `onParentDelete.enabled`\n // defaults to false, so such an edge orphans its children on a plain parent delete AND on a\n // tenant purge (which dispatches the ordinary ORGANIZATIONS | DELETE and relies on the same\n // cascade), and a subject erasure reaching it is refused. Nothing reported the first two\n // until #1095 found a todo-list delete leaving its todos behind.\n //\n // WARN-only, ONE aggregated line, never a throw: an undeclared edge is a missing declaration\n // (each needs a per-edge decision — delete, retain scrubbed, or survive intact), and a\n // refusal here would fail boot on every application that has not made those decisions yet.\n // The classifier is the erasure runtime's own (`classifySubjectErasureDisposition`), so this\n // line names exactly the edges an erasure would refuse on.\n let unclassifiedLifecycleEdges: ReturnType<typeof collectUnclassifiedDependentLifecycleEdges> = [];\n try {\n unclassifiedLifecycleEdges = collectUnclassifiedDependentLifecycleEdges(\n resourcesRegistry.resourceConfigurations as any,\n );\n } catch (error) {\n this.logger.warn('⚠️ dependent-lifecycle-classification report skipped (validation error)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n if (unclassifiedLifecycleEdges.length > 0) {\n this.logger.warn(\n `⚠️ [dependent-lifecycle-unclassified] ${unclassifiedLifecycleEdges.length} DEPENDENT (COMPOSITION) edge(s) ` +\n `declare no usable onParentDelete lifecycle. Deleting such a parent leaves its children in place under a ` +\n `parent that no longer exists, a tenant purge leaves the same rows behind, and a subject erasure reaching ` +\n `the edge is refused. Each edge needs a declaration on the relationship: ` +\n `onParentDelete { enabled: true } (strategy DELETE, or IMPERSONALIZE_AND_RETAIN for a retention-governed ` +\n `child), or { enabled: false } to state that the rows survive their parent intact.`,\n {\n edges: unclassifiedLifecycleEdges.map((edge) =>\n `${edge.childResourceType} <- ${edge.parentResourceType}` +\n `${edge.foreignKeyField ? ` (${edge.foreignKeyField})` : ''} [${edge.disposition}]`),\n },\n );\n }\n\n // --- Composition seed op-path resolvability guard (onParentCreate lifecycle) ---\n // Complements the saas-models seedability guard above. That one verifies the\n // child's CREATE *DTO* is fillable; it cannot see whether the seed's SERVICE\n // op-path resolves — a backend-only concern. At seed time `createAsSystem`\n // resolves the child's default CREATE op via `getServiceOperationPathDefault`,\n // which accepts ONLY INTERNAL_CALL / API_CALL / API_CALL_WITH_CALLBACK — a\n // REPOSITORY_ONLY (or absent) default CREATE throws OPERATION_PATH_NOT_FOUND and\n // the runtime seed silently no-ops (the exact bug runtime-verify caught on the\n // first org/state adopters). Catch that class at boot, fail-closed, by reusing\n // the very resolver the seed uses (config-only, so callable here). Feature-gated\n // children are legitimately absent from the registry (the runtime seed skips\n // them the same way via `tryGetResourceConfiguration`) → they must not fail boot.\n const compositionSeedOpPathViolations: string[] = [];\n for (const childConfig of Object.values(\n resourcesRegistry.resourceConfigurations,\n ) as unknown as CompositionSeedabilityResourceInput[]) {\n const childResourceType = childConfig.resourceIdentifier;\n const parentRelationships: ResourceRelationship[] = childConfig.resourceRelationships?.parentRelationships ?? [];\n for (const relationship of parentRelationships) {\n if (relationship.nature !== RelationshipNature.COMPOSITION) continue;\n if (relationship.childOperations?.lifecycle?.onParentCreate?.enabled !== true) continue;\n // Feature-excluded child → absent from the registry → the runtime seed\n // skips it (same `tryGetResourceConfiguration` check), so don't fail boot.\n if (!this.resourcesRegistryService.tryGetResourceConfiguration(childResourceType)) continue;\n try {\n this.resourcesRegistryService.getServiceOperationPathDefault(\n childResourceType,\n CoreResourceOperation.CREATE,\n );\n } catch {\n compositionSeedOpPathViolations.push(\n `Composition child '${childResourceType}' (parent '${relationship.resourceType1}') enabled ` +\n `onParentCreate but createAsSystem cannot resolve a default CREATE service op-path — typically a ` +\n `REPOSITORY_ONLY or absent default CREATE variant (the service tier accepts only INTERNAL_CALL / ` +\n `API_CALL). The runtime seed would silently no-op. Make the default CREATE variant INTERNAL_CALL.`,\n );\n }\n }\n }\n if (compositionSeedOpPathViolations.length > 0) {\n throw new Error(\n `Resource configuration error — ${compositionSeedOpPathViolations.length} composition relationship(s) enabled ` +\n `onParentCreate seeding but their child has no service-resolvable default CREATE op:\\n` +\n compositionSeedOpPathViolations.map((message) => ` • ${message}`).join('\\n'),\n );\n }\n\n const resourceConfigurations = new Map(\n Object.entries(resourcesRegistry.resourceConfigurations) as [ResourceType, ResourceConfiguration<any, any, any>][]\n );\n\n if (platformPersistenceAdapter !== undefined && !isPlatformApplication) {\n throw new Error(\n 'platformPersistenceAdapter is a PLATFORM-MODE parameter. An application declares its '\n + 'persistence adapter in application config (DATABASE_DEFAULT_ADAPTER); accepting it here '\n + 'would smuggle the decision past that contract.',\n );\n }\n if (platformPersistenceAdapter !== undefined) {\n // BEFORE initializeRepositories, necessarily: this is the construction-time answer.\n this.repositoriesRegistryService.setPlatformModeDefaultPersistenceAdapter(platformPersistenceAdapter);\n }\n\n // Initialize repositories registry on the active default connection\n const activeConnection = this.mongoDBService.getConnection();\n await this.repositoriesRegistryService.initializeRepositories(resourceConfigurations, activeConnection || undefined);\n this.logDebug('✅ Repositories registry initialized successfully');\n\n // PostgreSQL DDL is owned OUTSIDE the engine (the schema planner plans; migrations apply),\n // so a PostgreSQL-backed table can silently disagree with what the repository writes — most\n // sharply for framework-owned columns no app schema declares. Prove the physical tables\n // match the plan HERE, once, rather than letting the first request fail on a bare\n // `column \"...\" does not exist`. Deliberately after `initializeRepositories` (the plans must\n // exist) and outside it (the PostgreSQL connection is lazy and need not be reachable while\n // repositories are being constructed). No-op unless a resource is PostgreSQL-backed, so it\n // never forces a connection an application does not use.\n // THE PRODUCTION MIGRATION DOOR (K7), deliberately immediately BEFORE the schema gate:\n // the runner brings the database to the shipped migrations' state, then the gate verifies\n // the result — so the gate stays the backstop even for the runner itself (K6). Both\n // no-op unless a resource is PostgreSQL-backed, and the runner additionally no-ops when\n // the deployable ships no migrations directory. Concurrency (N instances booting at\n // once) is the runner's own property via the in-database advisory lock.\n //\n // PLATFORM MODE DEFERS BOTH (Phase 5.2): the AppConfigurationService a platform service\n // hydrates AFTER this method cannot answer connection questions here, and this shared\n // body must not read it (the 2026-08-02 incident class, platform/CLAUDE.md). Platform\n // startups invoke `applyStartupPostgresMigrations()` + `verifyPostgreSqlTableSchemas()`\n // themselves — apps-manager immediately after this method returns (its Phase 2.5,\n // BEFORE its first repository read, with the connection supplied by the Phase-1\n // `connectWithUrl` pre-connect door rather than by hydration — Phase 5.3);\n // module-registry in its platform-owner phase, post-hydration.\n if (!isPlatformApplication) {\n this.logDebug('🚚 Applying startup PostgreSQL migrations (if any)...');\n await this.repositoriesRegistryService.applyStartupPostgresMigrations();\n\n this.logDebug('🧮 Verifying PostgreSQL physical table schemas...');\n await this.repositoriesRegistryService.verifyPostgreSqlTableSchemas();\n this.logDebug('✅ PostgreSQL physical table schemas verified');\n }\n\n // Preserve the historical post-repository factory lifecycle:\n // custom factories may resolve repository-backed services while\n // materializing their registrations.\n this.customImplRegistry.initialize([\n ...CoreBackend_ServiceImplementationsFactories,\n ...customServiceImplementations,\n ]);\n\n if (applicationConfig) {\n // Runtime-contract validation needs both the populated email\n // template registry and the finalized `transactionalCore`\n // registrations. It still runs before service/controller\n // initialization, so no operation can accept traffic first.\n this.logDebug('🧭 Validating initialized runtime contracts...');\n this.applicationStartupConfigValidator.validateInitializedRuntimeContracts(applicationConfig);\n // RAG store capability probe (fail-closed) — async because it EXECUTES a pgvector\n // expression on the live connection; no-op for applications with no `.ragSource()`\n // fields, so it never forces a database connection an application does not use.\n await this.applicationStartupConfigValidator.validateInitializedRagStoreCapability();\n // #1613: how many live rows the CURRENT retention schedule already puts past their period,\n // so a shortened period is visible before the retention-class sweep's next run. Never fatal.\n // Only in the runtime that enforces the classes: a confined runtime has no grant to count.\n if (bootAssertions.enforcesRetentionClasses) {\n const retentionConfigurations = this.resourcesRegistryService.getResourceTypes()\n .map((resourceType) => this.resourcesRegistryService.getResourceConfiguration(resourceType));\n await reportRetentionClassPositionsAtStartup({\n configurations: retentionConfigurations as never,\n allConfigurations: retentionConfigurations as never,\n schedule: applicationConfig.compliance?.dataRetention,\n repositoriesRegistry: this.repositoriesRegistryService,\n logger: this.logger,\n });\n }\n if (bootAssertions.assertsPersistenceTransactionReadiness) {\n await this.applicationStartupConfigValidator\n .validateInitializedRuntimeTransactionReadiness(\n applicationConfig,\n );\n } else {\n this.logDebug(\n '🧭 Skipping persistence transaction-readiness proof: this runtime does not own it '\n + '(ApplicationRuntimeProfileBootAssertions.assertsPersistenceTransactionReadiness). '\n + 'The probe touches a synthetic collection no resourceAccess declares, and proves a '\n + 'deployment-wide property the application backend already proves.',\n );\n }\n this.logDebug('✅ Initialized runtime contracts validated successfully');\n }\n\n // Step 4: Initialize services registry (business logic layer)\n this.logDebug('🏢 Initializing services registry...');\n await this.servicesRegistryService.initializeServices();\n\n // Step 4.0.5: Type every existing organization whose type resolves to nothing — none stored, or one the\n // configuration no longer declares — or refuse to start (#1032, #1036).\n //\n // After `initializeServices` because each assignment is recorded through the audit service, and before\n // anything below can read an organization — cascade observers, queue consumers, seeds, the owner-floor\n // report, the HTTP listener. The sign-in resolver refuses members of such an organization, so a\n // deployment holding one would otherwise start healthy with those members locked out.\n //\n // Platform services run the same step themselves once their migrations have applied (apps-manager's\n // Phase 2.5), against the platform's own declared types: this shared body does not know them. A confined\n // runtime skips it for the reason every maintenance step does — it holds no write on `organizations`\n // and is not accountable for the population.\n if (!isPlatformApplication && bootAssertions.performsBootSchemaMaintenance) {\n await assignDerivableOrganizationTypesAtBoot({\n repositoriesRegistry: this.repositoriesRegistryService,\n organizationTypes: applicationConfig?.organizationTypes,\n errorBuilder: this.errorBuilder,\n logger: this.logger,\n recordAssignment: async (assignment) => {\n if (!this.auditLogsService) {\n throw new Error('the audit logs service is not bound in this runtime');\n }\n // The application classifying its own tenants at boot — nobody asked (#1595).\n await this.auditLogsService.logOrganizationTypeAssigned(assignment, undefined, SYSTEM_AUDIT_PRINCIPAL);\n },\n });\n }\n\n // Step 4.1: Cascade-tier evidence observers (#365).\n //\n // Registered HERE — on the registry `initializeServices` just built, BEFORE any runtime\n // decorator below replaces `this.servicesRegistryService` — and that ordering is the\n // point. The cascade reads observers through the `servicesRegistry` each per-resource\n // service captured at construction, which is this undecorated instance. Registering on a\n // decorated wrapper would store the observer somewhere the cascade never looks, and\n // nothing would say so: the purge would still succeed and simply emit nothing.\n //\n // Unconditional: a tenant purge must leave per-credential evidence in every deployment.\n // An observer for a resource this runtime never registered is never dispatched, so the\n // minion and worker runtimes that share this startup pay nothing for it.\n if (container) {\n registerOrganizationProviderCredentialCascadeEvidence(this.servicesRegistryService, container);\n // A subject erasure's per-credential destruction record (#975): the same seam, the same\n // ordering constraint, and it emits only for a cascade that declares itself an erasure.\n registerUserProviderCredentialCascadeEvidence(this.servicesRegistryService, container);\n }\n\n if (servicesRegistryDecoratorFactory) {\n if (!applicationConfig) {\n throw new Error('servicesRegistryDecoratorFactory requires application configuration and cannot run during pre-hydration platform startup.');\n }\n this.servicesRegistryService = servicesRegistryDecoratorFactory(this.servicesRegistryService, {\n appConfig: applicationConfig,\n errorBuilder: this.errorBuilder,\n });\n this.rebindServicesRegistryForRuntime(container, this.servicesRegistryService);\n this.logDebug('✅ Runtime-specific services registry decorator installed');\n }\n this.logDebug('✅ Services registry initialized successfully');\n\n // Step 4.4: Supply the session revoker used when a subject erasure scrubs a person's row.\n //\n // Unconditional, unlike the billing effect below: an erased person's login must stop\n // working in every deployment, so this is a core privacy control rather than a\n // provider-tied one. Registered as a PORT rather than injected directly because\n // `AuthTokenIssuer` already depends on the services-registry handler, which is where the\n // scrub chokepoint that calls this lives — a direct dependency would close that cycle.\n if (container) {\n (container.get(SAAS_SERVICE_TYPES.SubjectSessionRevocationService) as SubjectSessionRevocationBackendService)\n .register(async (userId: string) => {\n await (container.get(SAAS_SERVICE_TYPES.AuthTokenIssuer) as AuthTokenIssuerBackendService)\n .invalidateAllTokensForUser(userId);\n });\n this.logDebug('🔒 Subject-erasure session revoker registered');\n }\n\n // Step 4.5: Initialize billing services (if enabled). Billing's provider-event handler is returned,\n // not registered here: it joins the application's handlers in the FATAL registration step below (#1629).\n let billingInboundHandler: AnyInboundHandlerDefinition | null = null;\n if (applicationConfig?.billing?.enabled && container) {\n billingInboundHandler = await this.initializeBillingServices(container, applicationConfig.billing, productDefinitions);\n }\n\n // Step 4.55: Register inbound handlers (#1596). FATAL on purpose and outside every non-fatal\n // catch: a misdeclared handler is a code defect, and a warning would leave a sender retrying into\n // a 404 while the process looks healthy. After billing (Step 4.5), because a provider endpoint may\n // be owned by either a capability handler or an inbound handler, and never by both.\n if (!isPlatformApplication && container) {\n this.registerInboundHandlers(container, billingInboundHandler ? [...inboundHandlers, billingInboundHandler] : inboundHandlers);\n }\n\n // Step 4.6: Initialize webhook auto-controller (must happen before controllers registry)\n if (!isPlatformApplication && container) {\n await this.initializeWebhookAutoController(container);\n }\n\n // Step 5: Initialize controllers registry (HTTP endpoints layer)\n this.logDebug('🌐 Initializing controllers registry...');\n\n\n // Get manual controllers from provided container\n let allCustomControllers: AbstractControllerBackendService[] = [];\n\n if (container) {\n // G-4: SCIM controller mount is app-global — it mounts when ANY registered\n // org type opts into scimProvisioning (organizationTypes[t].scimProvisioning.enabled).\n // Per-org / per-token enforcement happens downstream once mounted (DIRECTORY_PROVISIONING\n // feature + the org-type scimProvisioning.enabled gate via isScimProvisioningEnabledForOrg).\n // Fail-closed: off unless a type opts in.\n const directoryProvisioningEnabled = isScimProvisioningEnabledForAnyOrgType(\n this.resourcesRegistryService.getOrganizationTypesConfig(),\n );\n const analyticsEnabled = !!applicationConfig?.analytics?.enabled;\n const manualControllers = isPlatformApplication ? [] : getManualControllersBackend(container, { directoryProvisioningEnabled, analyticsEnabled });\n allCustomControllers = [\n ...manualControllers,\n ...(customControllers || [])\n ];\n\n\n\n this.logDebug('📋 Controllers to register', {\n manualControllers: manualControllers.length,\n runtimeCustomControllers: customControllers?.length || 0,\n totalCustomControllers: allCustomControllers.length\n });\n } else {\n allCustomControllers = customControllers || [];\n\n this.logDebug('📋 Controllers to register', {\n manualControllers: 0,\n runtimeCustomControllers: customControllers?.length || 0,\n totalCustomControllers: allCustomControllers.length\n });\n }\n if(!isPlatformApplication) {\n await this.controllersRegistryService.initialize(\n allCustomControllers.length > 0 ? allCustomControllers : undefined,\n controllerWhiteList\n );\n this.logDebug('✅ Controllers registry initialized successfully');\n } else {\n this.logDebug('Skipping controllers registry initialization in platform mode (will be started by apps-manager)');\n }\n\n // Step 5.5: Initialize batches/cronjobs (core engine + custom + resource-based)\n this.logDebug('🧵 Initializing batches & cronjobs...');\n const customBatches = customBatchesFactory\n ? customBatchesFactory({\n logger: this.logger,\n errorBuilder: this.errorBuilder,\n errorHandler: this.errorHandler,\n executionContextCreatorService: this.executionContextCreatorBackendService,\n resourcesRegistryService: this.resourcesRegistryService,\n repositoriesRegistryService: this.repositoriesRegistryService,\n servicesRegistryService: this.servicesRegistryService,\n })\n : new Map<string, BatchesCronjobsCustomExecution_Service<any, any>>();\n\n // Register core engine batches (always present, independent of custom app)\n customBatches.set(FILES_CLEANUP_BATCH_REF, createFilesCleanupBatch());\n // Hourly RAG reconciliation sweep (plan §3.c backstop, DL1). Registered UNCONDITIONALLY,\n // like files-cleanup: on an application with no `.ragSource()` fields it finds zero\n // resource types and zero chunk sets and costs one enumeration — a better trade than\n // corpus convergence silently depending on a registration condition. It is also the\n // bound every chunk-tier log-never-throw seam cites, so it must exist wherever they do.\n customBatches.set(RAG_RECONCILIATION_SWEEP_BATCH_REF, createRagReconciliationSweepBatch());\n // Five-minute RAG embedding drain (plan §3.d, Phase 4): fills the NULL-vector ledger\n // the sweep counts, and re-embeds on class→model binding moves. Registered\n // UNCONDITIONALLY for the sweep's reason — an app with no `.ragSource()` fields\n // returns after one detection walk; a RAG app with no embeddings provider gets a\n // visible missing-provider WARN instead of a silently frozen backlog.\n customBatches.set(RAG_EMBEDDING_DRAIN_BATCH_REF, createRagEmbeddingDrainBatch());\n customBatches.set(CONSUMABLE_TOKENS_CLEANUP_BATCH_REF, createConsumableTokensCleanupBatch());\n // Daily retention for the deferred-onboarding ledger (#1131). Registered UNCONDITIONALLY, like the token\n // cleanup beside it: an application that never defers onboarding has no rows and returns after one delete.\n customBatches.set(ORGANIZATION_ONBOARDING_OPERATIONS_CLEANUP_BATCH_REF, createOrganizationOnboardingOperationsCleanupBatch());\n // Hourly retention for the system-of-record write admissions (#1679). Registered UNCONDITIONALLY for the same\n // reason: an application that writes no read-through row has no admissions and returns after one delete.\n customBatches.set(SYSTEM_OF_RECORD_WRITE_ADMISSIONS_CLEANUP_BATCH_REF, createSystemOfRecordWriteAdmissionsCleanupBatch());\n customBatches.set(A2A_ABANDONED_TASK_SWEEP_BATCH_REF, createA2AAbandonedTaskSweepBatch());\n // Every minute: fails an approval pause nobody answered inside its window (#484; per-gate lapses since #1628). Registered\n // UNCONDITIONALLY, like the abandoned-task sweep beside it — an application with no agent\n // turn awaiting a person lists nothing and returns. Correctness does not wait on it (a late\n // decision is refused at use); the RECORD does, or an unanswered pause reads as live forever.\n customBatches.set(APPROVAL_PAUSE_EXPIRY_SWEEP_BATCH_REF, createApprovalPauseExpirySweepBatch());\n // Every minute: fires pending decisions' CLAIM and DECISION deadline stages (#1628). Registered\n // UNCONDITIONALLY: every gate gets default reminders, and a run with nothing due lists nothing.\n customBatches.set(DECISION_DEADLINE_SWEEP_BATCH_REF, createDecisionDeadlineSweepBatch());\n // Every five minutes: fails a conversational turn whose process died mid-turn, from its liveness\n // lease (#1780). Registered UNCONDITIONALLY, like the two sweeps above: an application with no turn\n // running lists nothing, and one with no Redis abstains, because there no lease can be trusted.\n customBatches.set(INTERRUPTED_TURN_SWEEP_BATCH_REF, createInterruptedTurnSweepBatch());\n // Every declared autonomous agent that carries a `schedule` (#1611), from the one declaration — no\n // second list. A ref the application's own factory already registered is a defect, not an override.\n for (const declaration of this.flowsActorsRegistryService.getAutonomousAgents()) {\n if (!declaration.schedule) continue;\n const batchRef = autonomousAgentScheduleBatchRef(declaration.ref);\n if (customBatches.has(batchRef)) {\n throw new Error(`Autonomous agent \"${declaration.ref}\" declares a schedule, and the application also registers batch \"${batchRef}\" itself; declare it in one place.`);\n }\n customBatches.set(batchRef, createAutonomousAgentScheduleBatch(declaration.ref, declaration.schedule));\n }\n // Daily hygiene sweep for the invitation→membership-junction model: prunes\n // long-stale INVITED rows + orphan PENDING_INVITATION users. Always present\n // (invitations are a core org capability, not a feature-gated add-on).\n customBatches.set(ORGANIZATION_MEMBER_INVITATION_SWEEP_BATCH_REF, createOrganizationMemberInvitationSweepBatch());\n // Hourly sweep that lifts EXPIRED time-boxed suspensions. Registered UNCONDITIONALLY:\n // `organizationMembers | suspend` and `users | suspend_user` both accept a window and\n // persist the resolved instant, so an application without this batch records \"for seven\n // days\" and suspends forever. Unlike the invitation sweep above, correctness does NOT\n // hold without it — the batch is what makes the declared contract true.\n customBatches.set(SUSPENSION_REACTIVATION_SWEEP_BATCH_REF, createSuspensionReactivationSweepBatch());\n /*\n * Nightly relabelling of elapsed machine credentials and platform access grants.\n * Registered UNCONDITIONALLY, but for a DIFFERENT reason from the sweep above it, and\n * the difference is worth keeping straight: correctness does NOT depend on this one.\n * Every guard already compares `expiresAt` against now, so an elapsed credential is\n * refused whether or not this batch runs. What depends on it is the RECORD — without it\n * `EXPIRED` has no producer at all, and a listing of API keys, OAuth clients or access\n * grants shows elapsed ones as ACTIVE forever (#413).\n */\n customBatches.set(CREDENTIAL_EXPIRY_SWEEP_BATCH_REF, createCredentialExpirySweepBatch());\n /*\n * The scheduled flush that makes a METERED product bill (#415). Registered CONDITIONALLY,\n * unlike the two above it, because it is the one batch here whose work is meaningless\n * without a configured provider: `flushToProvider` returns \"Provider not initialized\" on\n * every tick, which would put an error line in the log of every application that has no\n * billing every five minutes forever. A diagnostic that always fires is one operators stop\n * reading, and this batch's errors are the ones that say whose money went unbilled.\n *\n * The condition is the same `billing.enabled` the provider bootstrap below keys on, so the\n * batch exists exactly when the service it calls has been initialized.\n */\n if (applicationConfig?.billing?.enabled) {\n customBatches.set(USAGE_FLUSH_BATCH_REF, createUsageFlushBatch());\n /*\n * The scheduled reconciliation that makes a LOST webhook recoverable. Gated on the\n * same `billing.enabled` as the flush above it, and for the same reason: without a\n * provider it would report \"Provider not initialized\" every hour forever in every\n * application that has no billing, and a diagnostic that always fires is one nobody\n * reads — which matters most here, because this batch's findings are the ones that\n * say a customer's entitlements were wrong.\n */\n customBatches.set(BILLING_RECONCILIATION_BATCH_REF, createBillingReconciliationBatch());\n /*\n * The relay that DELIVERS what committed billing changes owe (#535): audit rows, feature\n * recomputation, notifications. Same `billing.enabled` gate: only billing writes the outbox, so\n * without billing every tick would find nothing, and the relay's consumers need the billing services.\n */\n customBatches.set(BILLING_EFFECT_OUTBOX_RELAY_BATCH_REF, createBillingEffectOutboxRelayBatch());\n /*\n * Recovery of subscription mutations whose provider outcome is unknown (#535 S7a): a held slot blocks every other\n * mutation of its subscription until this settles it. Same gate: only billing admits mutations.\n */\n customBatches.set(BILLING_SUBSCRIPTION_MUTATION_RECOVERY_BATCH_REF, createBillingSubscriptionMutationRecoveryBatch());\n }\n /**\n * Retention sweeps, one per engine `.ttl()` resource. Registered UNCONDITIONALLY, like the\n * suspension sweep above and for the same reason: without them the declared contract is\n * simply untrue on PostgreSQL, which has no native TTL. On MongoDB the TTL index also\n * expires these rows — the sweep then finds nothing and costs one cheap query, which is\n * a better trade than retention silently depending on which store an app happens to use.\n */\n customBatches.set(\n JOB_EXECUTIONS_RETENTION_SWEEP_BATCH_REF,\n createResourceRetentionSweepBatch(\n CoreResourceType.JOB_EXECUTIONS as ResourceType,\n ENGINE_JOB_EXECUTIONS_RETENTION_SWEEP_MANIFEST,\n ),\n );\n customBatches.set(\n JOB_PAYLOAD_STORAGE_RETENTION_SWEEP_BATCH_REF,\n createResourceRetentionSweepBatch(\n CoreResourceType.JOB_PAYLOAD_STORAGE as ResourceType,\n ENGINE_JOB_PAYLOAD_STORAGE_RETENTION_SWEEP_MANIFEST,\n ),\n );\n // #1613: the retention-class sweep — deletes every class-bound row whose declared period has ended,\n // through the service layer, on both adapters. Registered for EVERY application (like the `.ttl()`\n // sweeps): one that binds nothing finds zero resources and costs one registry walk, and a period the\n // privacy notice states must never depend on an application opting in. Two gates, both about WHERE:\n // - `applicationConfig` — a platform service registers the engine resources but holds no retention\n // schedule, so the sweep would find every class undeclared and delete nothing. Six bound engine\n // resources have platform tables: `providerCallRecords`, the two inbound-delivery resources and the\n // three service-provider resources. Measured 2026-09-25 for `providerCallRecords` only: no platform\n // service invokes an agent, so that table stays empty. The other five are written by application\n // tenant flows (inbound webhooks, service-provider relationships) that no platform service serves;\n // not separately measured. A platform service that starts writing any of them owes a schedule and\n // this registration.\n // - `enforcesRetentionClasses` — only the application backend: a minion's table-scoped role can\n // neither read nor delete the bound resources.\n if (applicationConfig && bootAssertions.enforcesRetentionClasses) {\n customBatches.set(RETENTION_CLASS_SWEEP_BATCH_REF, createRetentionClassSweepBatch());\n // #1598: the model-cost period close — the same runtime and the same reason: only the application\n // backend holds the tenants' detail rows and may write their aggregates.\n customBatches.set(MODEL_COST_PERIOD_CLOSE_BATCH_REF, createModelCostPeriodCloseBatch(applicationConfig.modelCostAccounting?.periodCloseCronSchedule));\n }\n // WS-A tenant teardown — destroys tenants whose retention window has elapsed.\n // Registered UNCONDITIONALLY (no feature gate) for real applications: `request_deletion`\n // is always reachable, so a tenant can always end up marked, and an application without\n // this batch would accumulate marked-but-never-destroyed tenants forever — the exact\n // failure a retention window exists to prevent. Every field of `tenantTeardown` defaults,\n // so an app that declares no block still purges on a 30-day window.\n //\n // Skipped for `isPlatformApplication`: platform services (apps-manager, crontabs-batches-\n // manager, ...) have no ORGANIZATIONS to tear down, and `applicationConfig` is\n // not yet populated at this point in a platform application's boot — it resolves config\n // in its own later phase, AFTER this `super.initialize()` call returns — so reading it here\n // unconditionally threw `app_configuration_not_initialized` at platform-apps-manager boot.\n if (applicationConfig) {\n customBatches.set(ORGANIZATION_PURGE_BATCH_REF, createOrganizationPurgeBatch(applicationConfig.tenantTeardown));\n }\n // Event-triggered (enqueued by the notifications dispatcher, no cron).\n // Registered unconditionally so any email notification enqueued onto\n // the custom-batch queue can resolve its executor.\n // Deferred child-lifecycle teardown (#427) — enqueued by\n // `ServiceResourceBackendService.queueChildDeletion` when a relationship declares\n // `ChildLifecycleMode.LAZY`, no cron. Registered UNCONDITIONALLY for exactly the reason\n // the email and webhook drains are: a job whose ref does not resolve hits\n // `JOB_BATCH_REF_NOT_FOUND` and is silently dead-lettered — and here that would mean a\n // child teardown that the parent delete already reported as done.\n customBatches.set(CHILD_LIFECYCLE_TEARDOWN_BATCH_REF, createChildLifecycleTeardownBatch());\n customBatches.set(EMAIL_BATCH_SEND_BATCH_REF, emailBatchSendService);\n // Event-triggered M2M outbound webhook delivery (enqueued by\n // `M2MWebhookDispatcherBackendService.enqueueDelivery`, no cron) and\n // SIEM webhook delivery (enqueued by\n // `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`, no\n // cron). Both are registered unconditionally for the SAME reason as\n // email: the dispatchers gate enqueue per-org/per-endpoint, so the\n // drains MUST always resolve — else an enqueued job hits\n // `JOB_BATCH_REF_NOT_FOUND` and is silently dead-lettered.\n customBatches.set(M2M_WEBHOOK_DELIVERY_BATCH_REF, m2mWebhookDeliveryBatchService);\n // Inbound deliveries (#1596): the dispatch drain and its sweep, unconditionally — an enqueued\n // dispatch with no registered batch would be dead-lettered, and the sweep is what re-drives a\n // delivery whose job was lost.\n customBatches.set(INBOUND_DELIVERY_DISPATCH_BATCH_REF, inboundDeliveryDispatchBatchService);\n customBatches.set(INBOUND_DELIVERY_SWEEP_BATCH_REF, inboundDeliverySweepBatchService);\n // Replies on inbound channels (#1630): the send drain and its sweep, unconditionally for the same reason.\n customBatches.set(INBOUND_REPLY_SEND_BATCH_REF, inboundReplySendBatchService);\n customBatches.set(INBOUND_REPLY_SWEEP_BATCH_REF, inboundReplySweepBatchService);\n // #1600: the email-domain re-check (a no-op when the application receives no email).\n customBatches.set(EMAIL_DOMAIN_RECHECK_BATCH_REF, emailDomainRecheckBatchService);\n customBatches.set(SIEM_WEBHOOK_DELIVERY_BATCH_REF, siemWebhookDeliveryBatchService);\n // The SIEM batching collector (#1379), scheduled by the delivery worker when a\n // destination batches. Registered unconditionally for the same reason as the drain it\n // partners: whether a flush job is ever enqueued is a per-destination CONFIG decision\n // (`delivery.batchSize > 1`), so the ref must always resolve or an operator enabling\n // batching would silently dead-letter every flush and their events would sit pending.\n customBatches.set(SIEM_DELIVERY_FLUSH_BATCH_REF, siemDeliveryFlushBatchService);\n // A2A push-notification delivery (enqueued by `A2APushDispatcherBackendService` on a\n // task transition, no cron). Registered unconditionally for the same reason as its two\n // siblings above: the dispatcher gates enqueue per registered webhook, so the drain\n // MUST always resolve — an enqueued job that hits `JOB_BATCH_REF_NOT_FOUND` is silently\n // dead-lettered, which for a notification means the client is never told and nothing\n // says so.\n customBatches.set(A2A_PUSH_DELIVERY_BATCH_REF, a2aPushDeliveryBatchService);\n // Audit Phase 3 — cron completeness reconciler. Registered unconditionally\n // (like the sibling delivery drains) so a mis-set global flag can't orphan the\n // schedule; it no-ops cleanly when no reconcilable audit sink is declared.\n customBatches.set(IMMUDB_AUDIT_RECONCILE_BATCH_REF, immudbAuditReconcileBatchService);\n // Audit Phase 5 / F1 — cron audit-log ARCHIVAL. Registered\n // unconditionally (like the reconcile batch); it no-ops cleanly at\n // tick time when no horizon resolves (neither `auditTrail.archiveAfterDays`\n // nor the declared `dataRetention[AUDIT_LOGS]` period, #1613) or\n // no file-storage provider is configured. Never deletes (AUDIT_LOGS\n // is immutable, G5) — it copies aged rows to durable archival\n // artifacts.\n customBatches.set(AUDIT_LOGS_ARCHIVE_BATCH_REF, auditLogsArchiveBatchService);\n\n if (applicationConfig && this.appConfigService.anonymousSessionsEnabled) {\n customBatches.set(ANONYMOUS_SESSION_CLEANUP_BATCH_REF, createAnonymousSessionCleanupBatch());\n this.logDebug('✅ Anonymous session cleanup batch registered');\n }\n\n // Register lifecycle dormancy detection batch (only when lifecycle is enabled)\n if (lifecycleConfig?.enabled) {\n customBatches.set(DORMANCY_DETECTION_BATCH_REF, createDormancyDetectionBatch(lifecycleConfig.dormancyCronSchedule));\n this.logDebug('✅ Dormancy detection batch registered', { cronSchedule: lifecycleConfig.dormancyCronSchedule });\n }\n\n // Register data-seeding scheduled-rerun batch (Phase 7 / Item 47, Slice 5).\n //\n // Gate: at least one passed `dataSeeds` entry declares a `schedule?:`\n // block. We pre-filter the in-memory definitions array (rather than\n // querying the registry, which is hydrated later in Step 7) so apps\n // without any cron-opted-in seeds don't spawn a minute-tick cron that\n // would always no-op. Platform mode bypasses entirely (no per-tenant\n // data seeds run on the platform process).\n if (applicationConfig) {\n const hasScheduledSeeds = (dataSeeds ?? []).some((seed) => seed.schedule !== undefined);\n if (hasScheduledSeeds) {\n // Fallback ladder is flat by design: the Zod schema\n // applies `DATA_SEEDING_SCHEDULED_RERUN_DEFAULT_CRON`\n // as a default when `dataSeeding.scheduledRerunCronSchedule`\n // is missing but the `dataSeeding` block is present;\n // when the whole block is absent, we short-circuit to\n // the shared constant. Both branches land on the SAME\n // literal, so there's a single source of truth — no\n // `?? manifest.cronExpression ?? '* * * * *'` tail.\n const dataSeedingConfig = applicationConfig.dataSeeding;\n const cronSchedule = dataSeedingConfig?.scheduledRerunCronSchedule\n ?? DATA_SEEDING_SCHEDULED_RERUN_DEFAULT_CRON;\n customBatches.set(\n DATA_SEEDING_SCHEDULED_RERUN_BATCH_REF,\n createDataSeedingScheduledRerunBatch(cronSchedule),\n );\n this.logDebug('✅ Data-seeding scheduled-rerun batch registered', { cronSchedule });\n }\n\n // Register the ETL pipeline scheduled-run batch (partial-resource paper, PR-12).\n //\n // Gate: at least one registered resource declares `externalDataPipeline.scheduleCron` — the\n // resources registry is initialized in an earlier step, so we query it directly.\n // Apps with no scheduled pipelines don't spawn a minute-tick cron that would\n // always no-op; on-demand pipelines (no `scheduleCron`) run only through the\n // run service's imperative door. Same platform-mode bypass as the sibling above.\n const hasScheduledEtlPipelines = this.resourcesRegistryService\n .getResourceTypes()\n .some((resourceType) => {\n const configuration = this.resourcesRegistryService.getResourceConfiguration(resourceType) as {\n externalDataPipeline?: { scheduleCron?: string };\n };\n return configuration?.externalDataPipeline?.scheduleCron !== undefined;\n });\n if (hasScheduledEtlPipelines) {\n customBatches.set(\n EXTERNAL_DATA_PIPELINE_SCHEDULED_RUN_BATCH_REF,\n createExternalDataPipelineScheduledRunBatch(),\n );\n this.logDebug('✅ ETL pipeline scheduled-run batch registered');\n }\n\n // Register data-seeding run-cleanup batch (audit L4-10,\n // post-Phase-7 close-out). Daily retention sweep that prunes\n // terminal `DataSeedRun` rows older than\n // `DataSeedingConfig.runRetentionDays` (default 30) while\n // preserving the MAX(seedVersion) row per business-key group\n // (so dispatcher idempotency is never broken).\n //\n // Gate: any registered seeds (regardless of `schedule?:`).\n // Apps with no seeds produce no `DataSeedRun` rows so the\n // sweep would always no-op. Platform mode bypasses (no\n // per-tenant data seeds run on the platform process).\n //\n // Retention is read at TICK time from app config (NOT at\n // registration), so an in-place config change takes effect\n // on the next daily tick without redeploy — see the\n // manifest's JSDoc and `resolveRetentionDays()` in the\n // batch body.\n const hasAnySeeds = (dataSeeds ?? []).length > 0;\n if (hasAnySeeds) {\n customBatches.set(\n DATA_SEEDING_RUN_CLEANUP_BATCH_REF,\n createDataSeedingRunCleanupBatch(),\n );\n this.logDebug('✅ Data-seeding run-cleanup batch registered');\n }\n }\n\n await this.batchesExecutor.initialize(customBatches);\n this.logDebug('✅ Batches & cronjobs initialized');\n\n // Step 5.9: Wire the data-seed declarations — registry, scope resolvers, Level-B resource-lifecycle\n // hooks, LAZY guards — BEFORE the HTTP server listens. A request that reaches the services registry\n // before these exist runs without its seeds, and a missed `afterCreate` is never retried. The\n // application-lifecycle passes stay at Step 7.7. See `wireDataSeedingDeclarations`.\n this.wireDataSeedingStep(dataSeeds, dataSeedScopeResolvers, runtimeProfile);\n\n // Step 6: Initialize HTTP server (skip here in platform mode or headless runtimes)\n if (this.shouldInitializeHttpServer({ headlessMode })) {\n // Register operator-facing admin controllers BEFORE HTTP init so they get\n // mounted at their custom root paths (e.g. /internal/admin/data-seeding)\n // by registerRoutes(). They MUST go through registerCustomController(), not\n // through getManualControllersBackend(), because the manual-controllers list\n // is mounted under /api/v1 by the controllers registry — root-level admin\n // surfaces (mirroring /health) must skip that prefix.\n if (container) {\n try {\n const dataSeedingAdminController = container.get(\n SAAS_SERVICE_TYPES.DataSeedingAdminController,\n ) as DataSeedingAdminBackendController;\n this.httpServerService.registerCustomController(dataSeedingAdminController);\n this.logDebug('🌱 Data-seeding admin controller registered for root mount');\n\n // The external-data operator door (list pipelines + run one now). Same\n // root-mount reasoning, and registered beside its sibling so a future\n // reader finds every /internal admin surface in one place.\n const externalDataAdminController = container.get(\n SAAS_SERVICE_TYPES.ExternalDataAdminController,\n ) as ExternalDataAdminBackendController;\n this.httpServerService.registerCustomController(externalDataAdminController);\n this.logDebug('🔌 External-data admin controller registered for root mount');\n } catch (error) {\n this.logger.warn('⚠️ Failed to register DataSeedingAdminController; admin endpoints will be unavailable', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n this.logger.info('🌍 Initializing HTTP server...');\n await this.httpServerService.initialize();\n this.logger.info('✅ HTTP server initialized successfully');\n } else if (this.isPlatformMode) {\n this.logDebug('Skipping HTTP server initialization in platform mode (will be started by apps-manager)');\n } else {\n this.logDebug('Skipping HTTP server initialization in headless mode');\n }\n\n // Step 7: Initialize queue workers (for background job processing)\n if (!this.isPlatformMode) {\n this.logger.info('🐰 Initializing queue workers...');\n try {\n // Headless job-processing runtimes (minions) still connect to\n // RabbitMQ here — their own tick consumer needs the adapter\n // connection + topology channel — but must NOT consume the\n // shared operations/scheduled/callbacks queues, or RabbitMQ\n // round-robins the scheduled-cron ticks onto them and they\n // dead-letter every tick they can't interpret. We also turn\n // OFF queue monitoring for those runtimes: it watches exactly\n // those four shared queues (which this runtime doesn't own),\n // and the backend-api pod already monitors them.\n await this.queueWorkerInitializer.initialize(\n skipJobConsumers\n ? { startJobConsumers: false, enableMonitoring: false }\n : undefined,\n );\n this.logger.info('✅ Queue workers initialized (if RabbitMQ configured)');\n } catch (error) {\n // Queue workers failing shouldn't prevent app from starting\n this.logger.warn('⚠️ Queue worker initialization skipped or failed:', error);\n }\n\n // Step 7.5: Sync cron jobs to crontabs-batches-manager\n if (this.shouldSyncCronJobs({ skipCronSync })) {\n this.logger.info('🕐 Syncing cron jobs to crontabs-manager...');\n try {\n // Initialize the sync service\n this.cronJobSyncService.initialize();\n\n // Sync cron jobs WITHOUT awaiting. Transient failures do not fail startup:\n // CronJobSyncBackendService keeps one capped, process-lifecycle-aware\n // reconciliation retry pending. It must not HOLD startup either: the remote\n // client waits for crontabs-manager's readiness with no bound, and that\n // readiness depends on apps-manager's. Awaited, one unready platform\n // service stalled every later step for ~20 minutes (2026-09-14), while the\n // HTTP server was already answering.\n void this.cronJobSyncService.syncCronJobsToManager().catch((error: unknown) => {\n this.logger.error('Unexpected cron job sync failure', { ...projectCaughtErrorLogFields(error) });\n });\n } catch (error) {\n // This catch is a final guard for an unexpected service\n // defect in `initialize()`; ordinary remote failures are contained and\n // retried by CronJobSyncBackendService.\n this.logger.error('Unexpected cron job sync failure:', error);\n }\n } else {\n this.logDebug('Skipping cron job sync for this runtime profile');\n }\n } else {\n this.logDebug('Skipping queue worker initialization in platform mode');\n }\n\n /*\n * Step 7.65: resolve the CANONICAL application identity once, so the synchronous\n * scope-derivation sites can read it without a repository round trip.\n *\n * Placed immediately before seeding because that is the earliest point the APPLICATION\n * row is guaranteed to exist — the seed dispatcher refuses outright without it — and\n * because every seeded row anchored to the application scope should be written under the\n * same id the request paths will later filter on.\n *\n * Deliberately NOT swallowed. A backend that cannot name its own application would go on\n * to write `applicationId` columns from `AppConfigurationService.applicationId`, which is\n * the PLATFORM's id and matches no scope predicate — silently, and unrecoverably for the\n * rows written meanwhile. Failing the boot is the cheaper outcome.\n */\n await this.primeApplicationIdentityStep();\n\n // Step 7.7: Data-seeding subsystem — run the application-lifecycle seed passes (Phase 2.F of the\n // seeding-first-class plan). The declarations were wired at Step 5.9, before the HTTP server listened.\n // Extracted into `runDataSeedingStep()` so it can be unit-tested in\n // isolation without standing up the full 30+ dependency boot chain.\n await this.runDataSeedingStep();\n\n // Step 7.8: Report — not enforce — the last-super-administrator floor. Runs AFTER\n // seeding so a seeded first administrator counts; see `reportSuperAdminFloor()` for why\n // this can never be fatal.\n await this.reportSuperAdminFloor();\n\n // Step 7.9: The per-tenant twin. Separate call, separate report: the application floor\n // answers \"can anyone administer this deployment\", this one answers \"which tenants can\n // nobody administer\" — different populations, different remedies, and an operator\n // needs both named rather than one folded into the other.\n await this.reportOrganizationOwnerFloor();\n\n // Step 7.91: The APPLICATION-OWNER organization (#1054) — a third population question of\n // the same family, and the only one that can be answered wrongly by a DIRECT DATABASE\n // EDIT rather than by an unguarded write path. Non-fatal for the same reason as its two\n // neighbours: a diagnostic must never be why startup fails.\n await this.reportApplicationOwnerOrganization();\n\n // Step 7.95: The CEILING, beside the two floors. They ask \"is there at least one\n // administrator\"; this asks \"who are they\" — the enumeration a periodic privileged-access\n // review reads (#202). Same non-fatal posture, same gate, and it decides nothing.\n await this.reportPrivilegedAccessPopulation();\n\n // Step 7.10: Report — never enforce — which of the APPLICATION's own resources have said\n // nothing about whether their rows are about people. Reads the registry only: no database,\n // no execution context, so unlike the two floors above it needs nothing to be seeded and\n // cannot be confined to an empty set by a wrong context.\n this.reportApplicationPersonalDataDeclarations();\n\n // Step 7.11: Report — never repair — stored provider credentials no current-contract lookup reaches because\n // their slot name is one the provider no longer declares (#624). Same non-fatal posture as\n // the reports above: it reads the two credential stores and decides nothing.\n await this.reportStoredProviderCredentialSlots(\n container?.isBound?.(SAAS_SERVICE_TYPES.SystemAccessService)\n ? container.get(SAAS_SERVICE_TYPES.SystemAccessService) as SystemAccessBackendService\n : undefined,\n );\n\n // Step 8: Validate initialization\n await this.validateInitialization({ headlessMode });\n\n // Step 8.5: If the application's authored authentication policy (`userTypes.*.auth` —\n // MFA, password, lockout, enabled methods, step-up, session) moved since the last boot,\n // record it in the audit trail. Emitted HERE — after `validateInitialization`, with the\n // repositories registry and the audit boundary live and the resolved policy in effect —\n // because this boot is where the change takes effect and there is no human actor to name\n // (the \"who authored it\" lives in the deployment / source history).\n //\n // Gated three ways: `applicationConfig` is undefined in platform mode (the platform-gate);\n // and `!headlessMode` restricts the emit to the auth-SERVING runtime. A minion boots this\n // same lifecycle headlessly (`headlessMode: true`) with the SAME app config, so without\n // this gate every minion would write a duplicate row for one change — and a background\n // runtime that serves no HTTP/auth is not the honest emitter of an authentication-policy\n // change anyway. `shouldInitializeHttpServer` draws the identical `!headlessMode` line.\n // (Horizontally-scaled serving replicas can still race to one extra row per change; that\n // is safe over-recording in an append-only trail — the gap this closes is UNDER-recording.)\n // The service call is fully self-contained and fire-and-forget, so it cannot fail boot.\n //\n // assurance-control: WILDO.AUDIT.SECURITY_EVENT WILDO.IDENTITY.SESSION_ASSURANCE — the boot-time\n // activation point that guarantees a change to the authored authentication-assurance policy is\n // evidenced, from the auth-serving runtime, on the deployment that puts it into effect.\n if (applicationConfig && this.auditLogsService && !headlessMode) {\n // The audit writer resolves the local owning identity before any persistence or fanout.\n // Authentication and audit-viewer policies are observed together without inventing a user type.\n await this.auditLogsService.emitApplicationAuthPolicyChangeIfChanged({\n userTypes: applicationConfig.userTypes,\n auditApplicationReadAccess: applicationConfig.auditTrail?.applicationReadAccess,\n });\n }\n\n this.isInitialized = true;\n\n\n // Step 9: Display debug information (after initialization is complete)\n this.logDebug('📋 Displaying implemented Mongoose schemas...');\n this.debugDisplayMongooseSchemas({\n showSchemaStructure: true,\n showIndexes: true,\n maxFieldDepth: 2,\n });\n\n this.logDebug('🌐 Displaying registered routes...');\n this.debugDisplayRegisteredRoutes();\n\n this.logDebug('🎉 Backend application initialization completed successfully');\n\n } catch (error) {\n // This orchestration layer does not handle the failure; it propagates\n // it to the runtime host. Logging here would duplicate the terminal\n // process-boundary record and lose host identity/context.\n throw error;\n }\n }\n\n /**\n * Initialize the webhook auto-controller with its dependencies.\n *\n * Must run BEFORE the controllers registry mounts the controller's router:\n * `initialize()` is what actually registers the webhook routes (the route\n * set is data-dependent and the webhook handler is not constructor-injected,\n * so the base class's constructor-time `setupRoutes()` hook is a no-op — see\n * `WebhookAutoControllerBackendService.initialize()` for the full rationale).\n * Async because route definitions are read from first-class provider runtime contracts.\n */\n /**\n * Validate and register the application's inbound handlers (#1596). Throws — never warns — on any\n * misdeclaration, including a provider that holds the reserved `app` provider ref and a provider\n * endpoint owned by both a capability handler and an inbound handler.\n */\n private registerInboundHandlers(container: any, declaredHandlers: AnyDeclaredInboundHandler[]): void {\n // #1630: channel handlers are declared beside endpoint handlers and registered in this same fatal step.\n const inboundHandlers = declaredHandlers.filter((handler): handler is AnyInboundHandlerDefinition => !isInboundChannelHandler(handler));\n const channelHandlers = declaredHandlers.filter(isInboundChannelHandler);\n // #1600: the email channel's stage 1 — the provider's notification endpoint bound to the engine's email\n // intake — joins the endpoint handlers in this same fatal registration.\n const emailIntakeHandler = this.buildInboundEmailIntakeHandler(container, channelHandlers.length > 0);\n if (emailIntakeHandler) inboundHandlers.push(emailIntakeHandler);\n const registry = container.get(SAAS_SERVICE_TYPES.InboundHandlerRegistryService) as InboundHandlerRegistryBackendService;\n const backendProviderRegistry = this.backendProviderRegistryService;\n const endpointKeysByProviderRef = new Map<string, readonly string[]>();\n const endpointsByProviderRef = new Map<string, readonly Hook_Endpoint[]>();\n for (const provider of backendProviderRegistry.getProvidersWithProtocol(ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR)) {\n const providerRef = provider.metadata.ref;\n const enabled = this.externalProvidersRegistryService.isProviderEnabled(providerRef, ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR);\n const configuration = enabled\n ? this.externalProvidersRegistryService.getProviderConfiguration(providerRef, ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR) as { endpoints?: readonly Hook_Endpoint[] } | undefined\n : undefined;\n const endpoints = configuration?.endpoints ?? [];\n // Every provider that declares the protocol is listed, enabled or not, so the reserved-ref\n // refusal cannot be dodged by disabling the provider for one boot.\n endpointKeysByProviderRef.set(providerRef, endpoints.map((endpoint) => endpoint.key));\n endpointsByProviderRef.set(providerRef, endpoints);\n }\n registry.register(inboundHandlers, {\n endpointKeysByProviderRef,\n // The live role table, loaded at startup before this step, so inheritance is checked against the\n // application's own roles and not only the names a handler spelled.\n roleHierarchy: (role, scope) => this.authorizationsService.getRoleHierarchy(role as never, scope),\n });\n\n const webhookAutoController = container.get(SAAS_SERVICE_TYPES.WebhookAutoController) as WebhookAutoControllerBackendService;\n for (const handler of inboundHandlers) {\n if (handler.source.kind !== InboundSourceKind.PROVIDER_ENDPOINT) continue;\n const { providerRef, endpointKey } = handler.source;\n const endpoint = endpointsByProviderRef.get(providerRef)?.find((candidate) => candidate.key === endpointKey);\n if (endpoint && webhookAutoController.hasCapabilityHandler(endpoint.capability)) {\n throw new InboundHandlerDeclarationError(\n `handler '${handler.ref}' binds '${providerRef}:${endpointKey}', which the '${endpoint.capability}' capability handler already owns; a source has exactly one handler`,\n );\n }\n }\n this.registerInboundChannelHandlers(container, registry, inboundHandlers, channelHandlers);\n if (declaredHandlers.length > 0) {\n this.logger.info(`Inbound handlers registered: ${declaredHandlers.map((handler) => handler.ref).join(', ')}`);\n }\n }\n\n /**\n * Channel handlers (#1630): validated FATALLY like endpoint handlers, then admitted to the endpoint\n * registry as dispatchables so #1596's worker runs them. The email channel is served when\n * `EMAIL_INBOUND` is enabled AND a provider is selected for it; the dispatchable's origin is that\n * provider's notification endpoint.\n */\n private registerInboundChannelHandlers(\n container: any,\n registry: InboundHandlerRegistryBackendService,\n endpointHandlers: readonly AnyInboundHandlerDefinition[],\n channelHandlers: readonly AnyDeclaredInboundHandler[],\n ): void {\n const channels = container.get(SAAS_SERVICE_TYPES.InboundChannelHandlerRegistryService) as InboundChannelHandlerRegistryBackendService;\n const runtime = container.get(SAAS_SERVICE_TYPES.InboundChannelRuntimeService) as InboundChannelRuntimeBackendService;\n const emailInboundEnabled = this.externalProvidersRegistryService.isEngineCapabilityEnabled(EngineCapability.EMAIL_INBOUND);\n const emailInboundProvider = this.externalProvidersRegistryService.getPrimaryProviderForEngineCapability(EngineCapability.EMAIL_INBOUND);\n channels.register(channelHandlers.filter(isInboundChannelHandler), {\n channelServed: () => ({ enabled: emailInboundEnabled, providerSelected: emailInboundProvider !== undefined }),\n endpointHandlerRefs: new Set(endpointHandlers.map((handler) => handler.ref)),\n roleHierarchy: (role, scope) => this.authorizationsService.getRoleHierarchy(role as never, scope),\n });\n if (channels.getHandlers().length === 0 || !emailInboundProvider) return;\n const contract = this.externalProvidersRegistryService.getProviderRuntimeContract(emailInboundProvider, ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER) as { notificationEndpointKey?: string } | undefined;\n if (!contract?.notificationEndpointKey) {\n throw new InboundHandlerDeclarationError(`the EMAIL_INBOUND provider '${emailInboundProvider}' declares no email-inbound runtime contract, so no message could reach a channel handler`);\n }\n registry.registerChannelDispatchables(channels.getHandlers().map((handler) =>\n runtime.toDispatchable(handler, { providerRef: emailInboundProvider, endpointKey: contract.notificationEndpointKey! })));\n }\n\n /**\n * The email channel's stage-1 handler (#1600), when the application receives email: EMAIL_INBOUND enabled, a\n * provider selected, and channel handlers declared. Refuses — FATALLY, like every other step here — a provider\n * whose base URL is overridden outside development and test (E7) — which is also what gates the DNS stand-in.\n */\n private buildInboundEmailIntakeHandler(container: any, channelHandlersDeclared: boolean): AnyInboundHandlerDefinition | null {\n const provider = container.get(SAAS_SERVICE_TYPES.InboundEmailProviderService) as InboundEmailProviderBackendService;\n // The SENDING provider's override too: the test lane captures replies at the same stand-in (E7).\n const sendingProviderRef = this.externalProvidersRegistryService.getPrimaryProviderForEngineCapability(EngineCapability.EMAIL_TRANSACTIONAL);\n if (sendingProviderRef) {\n const sending = this.externalProvidersRegistryService.getProviderRuntimeContract(sendingProviderRef, ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER) as { baseUrlOverrideEnvVarName?: string } | undefined;\n assertNoProviderBaseUrlOverrideOutsideDevelopment({\n providerRef: sendingProviderRef,\n envVarName: sending?.baseUrlOverrideEnvVarName,\n environment: readDeclaredOutboundAdmissionEnvironment(container.get(SAAS_SERVICE_TYPES.AppConfigService)),\n });\n }\n if (!provider.isEnabled()) return null;\n provider.assertStartupSafe();\n if (!channelHandlersDeclared) return null;\n const providerRef = this.externalProvidersRegistryService.getPrimaryProviderForEngineCapability(EngineCapability.EMAIL_INBOUND)!;\n const contract = this.externalProvidersRegistryService.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER) as { notificationEndpointKey?: string } | undefined;\n if (!contract?.notificationEndpointKey) {\n throw new InboundHandlerDeclarationError(`the EMAIL_INBOUND provider '${providerRef}' declares no email-inbound runtime contract, so no message could reach a channel handler`);\n }\n return createInboundEmailNotificationHandler({\n providerRef,\n endpointKey: contract.notificationEndpointKey,\n reception: container.get(SAAS_SERVICE_TYPES.InboundEmailReceptionService) as InboundEmailReceptionBackendService,\n });\n }\n\n private async initializeWebhookAutoController(container: any): Promise<void> {\n const inbound = {\n registry: container.get(SAAS_SERVICE_TYPES.InboundHandlerRegistryService) as InboundHandlerRegistryBackendService,\n receiver: container.get(SAAS_SERVICE_TYPES.InboundDeliveryReceiverService) as InboundDeliveryReceiverBackendService,\n };\n // FATAL, and before the provider pass below: the application's own inbound endpoints must not be\n // left unmounted by a provider's failure, which that pass only logs (#1596).\n (container.get(SAAS_SERVICE_TYPES.WebhookAutoController) as WebhookAutoControllerBackendService).mountApplicationEndpoints(inbound);\n try {\n const webhookHandler = container.get(SAAS_SERVICE_TYPES.WebhookHandlerService) as WebhookHandlerBackendService;\n const webhookAutoController = container.get(SAAS_SERVICE_TYPES.WebhookAutoController) as WebhookAutoControllerBackendService;\n\n await webhookAutoController.initialize(webhookHandler, inbound);\n this.logDebug('🔗 Webhook auto-controller initialized');\n } catch (error) {\n // Non-fatal — if no webhook providers are registered, this is expected\n this.logger.warn('Webhook auto-controller initialization skipped', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /**\n * Initialize billing services when billing is enabled.\n *\n * Resolves the billing provider from the external connectors system\n * and initializes all billing services (product catalog sync,\n * usage metering, promotions, custom implementations) and wires up webhooks.\n */\n private async initializeBillingServices(\n container: any,\n billingConfig: BillingConfiguration,\n appProductDefinitions?: ProductDefinition[],\n ): Promise<AnyInboundHandlerDefinition | null> {\n this.logDebug('💳 Initializing billing services...');\n\n // Resolve the billing provider BEFORE the non-fatal try below.\n //\n // \"billing.enabled = true but no provider resolvable\" is an\n // INCOHERENT CONFIG, not a runtime hiccup, and must FAIL LOUD at\n // startup. The previous warn-and-return silently degraded: billing\n // resources stayed registered (enabled ⇒ not excluded) but the\n // back-office services that register their operation paths + run\n // the org auto-create never initialized. The result was request-\n // time FATALs (`resources_registry_operation_path_not_found` on\n // `organizationBillingAccounts` / `products` / `prices` /\n // `promotions`) during org provisioning — exactly the\n // silent-degradation anti-pattern the design philosophy forbids.\n //\n // The try/catch further down stays scoped to RUNTIME init errors\n // (a provider that resolves but then throws mid-wire) which remain\n // non-fatal. Config incoherence is a different, fatal class.\n const resolution = await this.resolveBillingProvider(billingConfig);\n // Literal equality, not truthiness: this package compiles without `strictNullChecks`, under which\n // `!resolution.resolved` cannot exclude the success member (its `true` may still be null there).\n if (resolution.resolved === false) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: describeBillingProviderResolutionFailure(\n resolution.reason,\n billingConfig,\n resolution.detail,\n ),\n providerRef: billingConfig.providerRef ?? null,\n resolutionFailureReason: resolution.reason,\n },\n });\n }\n // Captured while `resolution` is narrowed to its success variant — the ref rows are stamped with.\n const billingProviderRef = resolution.providerRef;\n // Every consumer below receives the adapter WRAPPED, so each call it makes to the vendor leaves an outbound record\n // (#1712). Wrapped here, once, rather than inside the adapter: see `billing-provider-call-recording.backend.ts`.\n // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every billing call to the vendor is recorded.\n const capabilityCallRecorder = container?.isBound?.(SAAS_SERVICE_TYPES.ProviderCapabilityCallRecorder)\n ? container.get(SAAS_SERVICE_TYPES.ProviderCapabilityCallRecorder) as ProviderCapabilityCallRecorderBackendService\n : undefined;\n const billingProvider = capabilityCallRecorder === undefined\n ? resolution.provider\n : recordBillingProviderCalls(resolution.provider, { providerRef: billingProviderRef, recorder: capabilityCallRecorder });\n // Prepared inside the non-fatal try once the router exists, and BUILT after it (#1629): the handler's own declaration checks\n // (a billing endpoint with no scope binding, a role an engine handler may not hold) are code defects that must stop startup, not\n // be read as a provider-API failure the application may run without — which would leave the provider retrying into a 404.\n let buildBillingInboundHandler: (() => AnyInboundHandlerDefinition) | null = null;\n\n try {\n // 2. Get billing services from DI container\n const catalogSync = container.get(SAAS_SERVICE_TYPES.ProductCatalogSyncService) as ProductCatalogSyncBackendService;\n const usageMetering = container.get(SAAS_SERVICE_TYPES.UsageMeteringService) as UsageMeteringBackendService;\n const billingReconciliation = container.get(SAAS_SERVICE_TYPES.BillingReconciliationService) as BillingReconciliationBackendService;\n\n // 3. Product definitions from the custom app (like customRoles, customFeatureDefinitions)\n const productDefinitions: ProductDefinition[] = appProductDefinitions ?? [];\n\n // 4. Initialize services in dependency order\n await catalogSync.initialize(productDefinitions, billingProvider);\n await usageMetering.initialize(billingProvider);\n // Every write of a subscription's provider-authoritative fields outside its own mutations — the webhooks and the\n // reconciliation sweep — goes through that subscription's mutation slot (#535 S6). One projection serves both, and\n // its slot identity names the configured application, never a request context's.\n const subscriptionProjection = new BillingSubscriptionProviderProjection({\n repositoriesRegistry: this.repositoriesRegistryService,\n unitOfWork: container.get(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService) as ResourcePersistenceUnitOfWorkBackendService,\n applicationId: () => resolveBillingMutationApplicationId(this.appConfigService),\n providerRef: () => billingConfig.providerRef,\n });\n // The reconciliation sweep needs the provider handle and that projection. Initialized here rather than lazily so a\n // deployment whose provider fails to resolve never reaches a state where the batch is registered and the service\n // behind it is not.\n await billingReconciliation.initialize(billingProvider, subscriptionProjection);\n // Recovery resends and reads back through the same resolved provider (#535 S7a).\n (container.get(SAAS_SERVICE_TYPES.BillingSubscriptionMutationRecoveryService) as BillingSubscriptionMutationRecoveryBackendService)\n .initialize(billingProvider);\n /*\n * Publish it for the post-operation usage hook (#415). A module-level seam rather than a\n * DI edge because the metering service injects the services registry and the hook lives\n * on that registry — injecting it there would be a container cycle. Set HERE, inside the\n * billing bootstrap, so an application with no billing leaves the getter null and the\n * hook costs one null check per write.\n */\n setUsageMeteringService(usageMetering);\n // The referral program (#1802), published through the same kind of seam and for the same reason.\n setReferralProgramService(container.get(SAAS_SERVICE_TYPES.ReferralProgramService) as ReferralProgramBackendService);\n\n // 4b. Register the provider-side half of subject erasure.\n //\n // Registered HERE, inside the billing bootstrap, because that is what keeps the erasure\n // orchestrator domain-agnostic: `system-access` runs whatever declared itself relevant to\n // a subject and never learns that billing exists. It also ties the effect's lifetime to\n // the provider's — a deployment with no billing provider configured registers nothing,\n // rather than registering an effect that would fail at erasure time.\n container\n .get(SAAS_SERVICE_TYPES.SubjectErasureExternalEffectsService)\n .register(createBillingSubjectErasureEffect({\n billingProviderRef,\n getBillingProvider: () => billingProvider,\n listBillingAccountsForSubject: async (billingAccountResourceType, scopeFieldName, subjectIds) => {\n const systemAccess = container.get(SAAS_SERVICE_TYPES.SystemAccessService) as SystemAccessBackendService;\n return normalizeSystemListResult(await systemAccess.listAsSystem(\n billingAccountResourceType,\n { [scopeFieldName]: { $in: subjectIds } },\n )) as Array<{ _id: string; providerCustomerId?: string }>;\n },\n listActiveSubscriptions: async (subscriptionResourceType, billingAccountFkField, billingAccountId) => {\n const systemAccess = container.get(SAAS_SERVICE_TYPES.SystemAccessService) as SystemAccessBackendService;\n return normalizeSystemListResult(await systemAccess.listAsSystem(\n subscriptionResourceType,\n {\n [billingAccountFkField]: billingAccountId,\n status: { $nin: TERMINAL_SUBSCRIPTION_STATUSES },\n },\n )) as Array<{ _id: string; providerSubscriptionId?: string }>;\n },\n logWarn: (message, context) => this.logger.warn(message, context),\n /*\n * Answered from the REGISTRY, not from `billingConfig.enabledScopes` — same\n * reasoning as `AbstractBillingBackendService.activeBillingScopeVariants`:\n * enabledScopes is the INPUT to the exclusion and the registry is its RESULT,\n * so a second read of the input is a copy free to drift.\n *\n * Evaluated per CALL rather than captured here: this closure is built during\n * startup and an erasure runs much later, so binding the answer now would pin\n * a boot-time reading into an effect that outlives it.\n */\n userBillingScopeIsRegistered: () => this.resourcesRegistryService\n .getResourceTypes()\n .includes(BILLING_SCOPE_TO_VARIANTS.userId.billingAccount as ResourceType),\n }));\n this.logDebug('🧹 Billing subject-erasure effect registered');\n\n // 4a. Sync product catalog to DB (ensures products/prices exist before billing state endpoint queries them)\n try {\n const syncResult = await catalogSync.syncProductCatalog();\n this.logDebug('📦 Product catalog synced at startup', {\n synced: syncResult.synced,\n created: syncResult.created,\n updated: syncResult.updated,\n featuresDirty: syncResult.featuresDirty.length,\n });\n } catch (syncError) {\n this.logger.warn('⚠️ Product catalog startup sync failed (non-fatal)', {\n ...projectCaughtErrorLogFields(syncError),\n });\n }\n\n // 4b. Initialize billing custom implementations (late-binding for resource-centric operations)\n const featureSync = container.get(SAAS_SERVICE_TYPES.BillingFeatureSyncService) as BillingFeatureSyncBackendService;\n const billingStateService = container.get(SAAS_SERVICE_TYPES.BillingStateService) as BillingStateBackendService;\n initializeBillingCustomImplementations(billingProvider, featureSync, billingStateService, billingConfig, this.errorBuilder, billingProviderRef);\n\n // 4c. Register post-operation hooks (feature sync fires automatically after subscription mutations)\n registerBillingPostOperationHooks(this.servicesRegistryService);\n\n // 5. Wire up billing webhooks (#1629). The provider's adapter still VERIFIES every request (Stripe's SDK\n // `constructEvent`); the durable inbound path stores, retries and replays it, and billing's ENGINE inbound\n // handler runs it under its declared roles. The handler is returned and registered in the fatal step.\n const webhookHandler = container.get(SAAS_SERVICE_TYPES.WebhookHandlerService) as WebhookHandlerBackendService;\n const billingAdapter = new BillingWebhookAdapter(billingProvider, billingConfig.providerRef);\n webhookHandler.registerAdapter(billingConfig.providerRef, BILLING_WEBHOOK_ENDPOINT_KEY, billingAdapter);\n\n const webSocketService = container.get(SAAS_SERVICE_TYPES.WebSocketService) as WebSocketService;\n setBillingWebSocketService(webSocketService);\n const webhookEventRouter = new BillingWebhookEventRouterBackendService(this.servicesRegistryService, this.resourcesRegistryService, this.logger, webSocketService, this.repositoriesRegistryService, subscriptionProjection);\n const billingEndpoint = this.externalProvidersRegistryService.isProviderEnabled(billingConfig.providerRef, ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR)\n ? (this.externalProvidersRegistryService.getProviderConfiguration(billingConfig.providerRef, ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR) as { endpoints?: readonly Hook_Endpoint[] } | undefined)\n ?.endpoints?.find((endpoint) => endpoint.key === BILLING_WEBHOOK_ENDPOINT_KEY)\n : undefined;\n if (billingEndpoint) {\n buildBillingInboundHandler = () => createBillingInboundHandler({\n providerRef: billingConfig.providerRef,\n endpoint: billingEndpoint,\n billingProvider,\n router: webhookEventRouter,\n catalogContext: (resourceType, operation) => this.executionContextCreatorBackendService.createForInternalServiceOperation({ resourceType, operationIdentifier: operation }),\n isResourceTypeServed: (resourceType) => this.repositoriesRegistryService.getRepository(resourceType as ResourceType) !== undefined,\n });\n } else {\n // Same outcome as before #1629 (no route): an application that enables billing but no webhook endpoint\n // receives no provider events. Said loudly, because the reconciliation sweep is then its only sync.\n this.logger.error(`Billing provider '${billingConfig.providerRef}' declares no enabled '${BILLING_WEBHOOK_ENDPOINT_KEY}' webhook endpoint — billing receives no provider events`);\n }\n\n this.logDebug('✅ Billing services initialized successfully', {\n providerRef: billingConfig.providerRef,\n enabledScopes: billingConfig.enabledScopes,\n });\n } catch (error) {\n // Billing initialization failure is non-fatal: the app can still run without billing\n this.logger.error('❌ Billing services initialization failed (billing will be unavailable)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n return buildBillingInboundHandler ? buildBillingInboundHandler() : null;\n }\n\n /**\n * Resolve the StandardBilling_Interface from the external providers system.\n *\n * Flow:\n * 1. Get the billing providerRef from config (e.g., 'stripe')\n * 2. Verify the configured provider exposes the billing protocol\n * 3. Load the billing runtime contract from the backend provider registry\n *\n * Returns a discriminated {@link BillingProviderResolution}: on failure the\n * `provider` is null and a `reason` (plus optional `detail`) names the exact\n * config surface at fault, so the startup guard can route the operator to the\n * right fix (scope authoring vs. secret vs. disabled) rather than a catch-all.\n */\n private async resolveBillingProvider(billingConfig: BillingConfiguration): Promise<BillingProviderResolution> {\n const providerRef = billingConfig.providerRef;\n if (!providerRef) {\n this.logDebug('No billing providerRef configured');\n return { resolved: false, reason: BillingProviderResolutionFailureReason.PROVIDER_REF_UNSET };\n }\n\n try {\n const runtimeContract = this.backendProviderRegistryService.getRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n );\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.BILLING) {\n // No billing runtime contract exposed to the backend registry for\n // this ref — the provider was filtered out of the active catalog\n // because it is not authored in `providers.scopes.backend`, or the\n // artifact has not been regenerated since it was. This is distinct\n // from \"secret missing\": the ref never reached the backend host.\n this.logDebug('Billing provider not reachable on the backend runtime', { providerRef });\n return {\n resolved: false,\n reason: BillingProviderResolutionFailureReason.PROVIDER_NOT_REACHABLE_ON_BACKEND,\n };\n }\n\n if (!this.externalProvidersRegistryService.isProviderEnabled(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n )) {\n this.logDebug('Billing provider disabled by external provider configuration', { providerRef });\n return { resolved: false, reason: BillingProviderResolutionFailureReason.PROVIDER_DISABLED };\n }\n\n // WHICH adapter serves this provider is asked BEFORE the secret is read, and the order\n // is deliberate: an unserved provider is a framework gap, and reporting \"your secret is\n // missing\" for it would send an operator to populate a credential that could never have\n // been used. Ask the answerable question first.\n //\n // The lookup is keyed on the contract's declared `sdkPackage`, never on the provider\n // ref, so `no-provider-ref-branches.guard.test.ts` still holds — and so does the\n // principle behind it, because nothing here BRANCHES: the registry answers which of the\n // adapters this engine ships serves the declaration, exactly as\n // `EngineBackendProviderRegistry.modules` answers which module serves a ref.\n //\n // This replaces a note proposing `sdkFactory: (secretKey, opts) => StandardBilling_Interface`\n // on the runtime contract, \"mirror of the LLM and email surfaces\". It is not reachable and\n // the two cited surfaces are not mirrors of this one — see the registry module's header\n // for the dependency edge that blocks it and what the alternative would cost.\n const adapterFactory = resolveBillingAdapterFactory(runtimeContract.sdkPackage);\n if (!adapterFactory) {\n this.logger.warn('Billing provider declares an sdkPackage this engine ships no adapter for', {\n providerRef,\n sdkPackage: runtimeContract.sdkPackage,\n supported: listSupportedBillingSdkPackages(),\n });\n return {\n resolved: false,\n reason: BillingProviderResolutionFailureReason.NO_ADAPTER_FOR_SDK_PACKAGE,\n detail: runtimeContract.sdkPackage,\n };\n }\n\n const secretRef = runtimeContract.secretRef;\n const secretKey = secretRef\n ? this.externalProvidersRegistryService.getProviderSecret(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n secretRef,\n )\n : undefined;\n if (!secretKey) {\n this.logger.warn('Billing provider configured but secret is missing', { providerRef, secretRef });\n return {\n resolved: false,\n reason: BillingProviderResolutionFailureReason.SECRET_MISSING,\n detail: secretRef,\n };\n }\n\n this.logDebug('Billing provider resolved from first-class billing runtime contract', {\n providerRef,\n sdkPackage: runtimeContract.sdkPackage,\n });\n return {\n resolved: true,\n provider: adapterFactory({ secretKey, apiVersion: runtimeContract.apiVersion }),\n providerRef,\n };\n } catch (error) {\n const detail = describeCaughtError(error);\n this.logger.warn('Failed to resolve billing provider', { providerRef, error: detail });\n return { resolved: false, reason: BillingProviderResolutionFailureReason.RESOLUTION_ERROR, detail };\n }\n }\n\n async shutdown(): Promise<void> {\n this.logDebug('Starting graceful shutdown');\n\n\n // Cancel delayed cron reconciliation before stopping queue workers, so\n // shutdown cannot start a fresh platform request in the background.\n this.cronJobSyncService.shutdown();\n\n // Then shut down queue workers and wait for in-flight jobs.\n try {\n await this.queueWorkerInitializer.shutdown();\n } catch (error) {\n this.logger.error('Error during queue worker shutdown', error as any);\n }\n }\n /**\n * Check if the application is initialized\n */\n public isApplicationInitialized(): boolean {\n return this.isInitialized;\n }\n\n /**\n * Get application configuration\n */\n public async getAppConfig(): Promise<AppConfiguration> {\n this.ensureInitialized();\n return this.appConfigService.config;\n }\n\n /**\n * Get resources registry\n */\n public getResourcesRegistry(): ResourcesRegistry {\n this.ensureInitialized();\n return this.resourcesRegistryService.getResourcesRegistry();\n }\n\n /**\n * Get repositories registry handler\n */\n public getRepositoriesRegistry(): RepositoriesRegistryHandlerBackendService {\n this.ensureInitialized();\n return this.repositoriesRegistryService;\n }\n\n /**\n * Debug function to display all implemented Mongoose schemas\n * Convenient access to schema debugging from the main application service\n */\n public debugDisplayMongooseSchemas(options: {\n showSchemaStructure?: boolean;\n showIndexes?: boolean;\n showVirtuals?: boolean;\n resourceTypeFilter?: string[];\n maxFieldDepth?: number;\n } = {}): void {\n this.logDebug('\\n🚀 === WILDO.AI BACKEND - MONGOOSE SCHEMAS DEBUG ===\\n');\n\n if (!this.isInitialized) {\n this.logDebug('⚠️ Application not initialized yet. Schemas may not be available.');\n return;\n }\n\n this.repositoriesRegistryService.debugDisplayMongooseSchemas(options);\n }\n\n /**\n * Quick debug summary of all schemas\n */\n public debugShowSchemasSummary(): void {\n this.logDebug('\\n🚀 === WILDO.AI BACKEND - SCHEMAS SUMMARY ===\\n');\n\n if (!this.isInitialized) {\n this.logDebug('⚠️ Application not initialized yet. Schemas may not be available.');\n return;\n }\n\n this.repositoriesRegistryService.debugShowSchemasSummary();\n }\n\n /**\n * Debug function to display all registered routes\n */\n public debugDisplayRegisteredRoutes(): void {\n this.logDebug('\\n🌐 === WILDO.AI BACKEND - REGISTERED ROUTES ===\\n');\n\n if (!this.isInitialized) {\n this.logDebug('⚠️ Application not initialized yet. Routes may not be available.');\n return;\n }\n\n this.controllersRegistryService.displayAllRoutes();\n }\n\n /**\n * Get the controllers registry for route registration\n */\n public getControllersRegistry(): ControllersRegistryHandlerBackendService {\n this.ensureInitialized();\n return this.controllersRegistryService;\n }\n\n /**\n * Get the services registry for business logic access\n */\n public getServicesRegistry(): ServicesRegistryHandlerBackendService {\n this.ensureInitialized();\n return this.servicesRegistryService;\n }\n\n /**\n * Get the HTTP server service instance\n */\n public getHttpServer(): HttpServerBackendService {\n this.ensureInitialized();\n return this.httpServerService;\n }\n\n /**\n * Get the authorizations service instance\n */\n public getAuthorizationsService(): AuthorizationsBackendService {\n this.ensureInitialized();\n return this.authorizationsService;\n }\n\n /**\n * Step 5.9 — data-seed declarations hand-off, before the HTTP server listens.\n *\n * Thin adapter around {@link wireDataSeedingDeclarations}: registers the seed corpus and scope\n * resolvers, and wires the Level-B hooks and LAZY guards. It runs before Step 6 because a request\n * served before the hooks exist runs without its seeds, and a missed `afterCreate` is never retried.\n * Runs in platform mode too (tenant lifecycle hooks must fire regardless of who runs Level A).\n */\n protected wireDataSeedingStep(\n dataSeeds: readonly DataSeedDefinition[] | undefined,\n dataSeedScopeResolvers: Readonly<Record<string, DataSeedScopeResolver>> | undefined,\n runtimeProfile: ApplicationRuntimeProfile = ApplicationRuntimeProfile.APPLICATION_BACKEND,\n ): void {\n wireDataSeedingDeclarations({\n dataSeeds,\n dataSeedScopeResolvers,\n /*\n * The framework's own seeds belong to the runtime that owns the application's data.\n *\n * A MINION or WORKER runs this same bootstrap with a SCOPED services registry that\n * refuses unscoped writes, so a Level-B seed there makes `wireLevelBResourceLifecycleHooks`\n * request access it is designed not to have. The platform is excluded for the narrower\n * reason that it is not an application and never registered these before.\n */\n registersEngineOwnedSeeds:\n runtimeProfile === ApplicationRuntimeProfile.APPLICATION_BACKEND && !this.isPlatformMode,\n logDebug: this.logDebug,\n registry: this.dataSeedRegistryService,\n scopeResolverRegistry: this.dataSeedScopeResolverRegistryService,\n dispatcher: this.dataSeedDispatcherService,\n servicesRegistry: this.servicesRegistryService,\n });\n }\n\n /**\n * Step 7.7 — application-lifecycle seed passes.\n *\n * Thin adapter around {@link runDataSeedingApplicationLifecyclePasses}: this\n * method exists so subclasses (e.g. `PlatformAppsManager_ApplicationStartupService`)\n * can override / observe the step without reaching into the helper, and\n * so the heavy `initialize()` reads as a flat sequence of `await`s.\n *\n * The helpers are unit-tested at\n * `~/data-seeding/services/__tests__/data-seed-application-bootstrap.backend.test.ts`.\n * See their JSDoc for the full contract (declarations are wired at Step 5.9,\n * dispatch is skipped in platform mode, dispatcher failures are FATAL).\n */\n /**\n * Step 7.65 — resolve and cache the canonical application identity.\n *\n * A thin adapter for the same reason `runDataSeedingStep` is one: it keeps `initialize()` a flat\n * sequence of awaits, and it gives a subclass a seam to observe or override the step.\n */\n protected async primeApplicationIdentityStep(): Promise<void> {\n const identity = await this.applicationIdentityService.prime();\n this.logDebug('Canonical application identity resolved', {\n applicationRecordId: identity._id,\n appSlug: identity.appSlug,\n });\n }\n\n protected async runDataSeedingStep(): Promise<void> {\n await runDataSeedingApplicationLifecyclePasses({\n isPlatformMode: this.isPlatformMode,\n logger: this.logger,\n logDebug: this.logDebug,\n dispatcher: this.dataSeedDispatcherService,\n });\n }\n\n /**\n * Report — never enforce — the last-super-administrator floor at startup.\n *\n * ## Why this exists next to the write guards\n *\n * Every write that could remove the last administratively usable super-administrator already\n * refuses (`super-admin-floor.backend.utils`, wired into the USERS role verbs, the core\n * UPDATE, DELETE and subject erasure). So this can only ever observe a breach that arrived\n * around those paths: a direct database edit, a restore from a backup taken mid-erasure, a seed\n * that authored no administrator, or — the one with no user row involved at all — a role-table\n * reconfiguration that dropped or renamed a custom role carrying\n * `inheritFrom: APP_ADMIN_SUPER_ADMIN`, silently reclassifying its holders as non-administrators.\n *\n * ## Why it MUST NOT fail startup\n *\n * A fresh application legitimately boots with zero users: the first administrator arrives\n * through seeding or first-run registration. A framework that refused to start on this data\n * condition would brick every greenfield app on its first run, and — worse — would make the\n * breach unrecoverable in exactly the situation where the operator needs the app up to fix it.\n * The finding is loud (`logger.error` + a CRITICAL audit event) and non-blocking. Rejected:\n * throwing `ErrorType.CONFIGURATION`, for both reasons above.\n *\n * ## Why every failure is swallowed\n *\n * A diagnostic that can take the application down is a worse defect than the one it reports.\n * The floor query needs the users repository and the role table; in platform mode, in reduced\n * runtime profiles, or in a minimal test container, either may legitimately be absent. All of\n * that degrades to a debug line.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — surface the absence of an\n * accountable administrative principal, which is unrecoverable in-product once reached.\n */\n protected async reportSuperAdminFloor(): Promise<void> {\n // Platform mode runs no application user population — there is no floor to measure.\n if (this.isPlatformMode) return;\n /**\n * ONLY the runtime that owns the application's administrative population.\n *\n * The report reads `users` and `organizations` across the whole application. A confined\n * runtime (minion/worker) holds table-scoped grants covering neither, so it cannot perform\n * the read — and has no accountability for the answer even if it could. Observed on a\n * clean-room PostgreSQL boot (2026-08-24): the marketing-scrapper minion produced\n * `permission denied for table users` and `for table organizations` on every startup.\n *\n * It never blocked anything — the report is non-fatal by design — which is precisely why it\n * lasted: a recurring, ignorable error inside an otherwise healthy boot. The application\n * backend still runs both reports, so no observation is lost.\n */\n if (!resolveApplicationRuntimeProfileBootAssertions(this.resolvedRuntimeProfile).reportsAdministrativeContinuityFloors) return;\n\n try {\n if (!this.repositoriesRegistryService.getRepository(CoreResourceType.USERS)) {\n this.logDebug('Skipping the super-administrator floor report: no users repository is registered');\n return;\n }\n\n const executionContext = await this.executionContextCreatorBackendService.createForInternalOperation({\n operation: this.resourcesRegistryService.getServiceOperationPathDefault(\n CoreResourceType.USERS,\n CoreResourceOperation.LIST,\n ),\n initiatorRoles: [\n {\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n },\n ],\n });\n\n const population = await measureUsableSuperAdminPopulation({\n executionContext,\n repositoriesRegistry: this.repositoriesRegistryService,\n errorBuilder: this.errorBuilder,\n conferringRoles: resolveSuperAdminConferringRoles(this.authorizationsService),\n });\n\n if (population.meetsFloor) {\n this.logDebug('Super-administrator floor satisfied', {\n usableSuperAdminCount: population.usableSuperAdminCount,\n });\n return;\n }\n\n // ERROR, not warn: there is no in-product remedy — every door that could appoint a new\n // administrator is gated on the role that is missing. The recovery is necessarily\n // out-of-band (a direct database write, or a seed), so the log has to stand alone and\n // say what to do.\n this.logger.error(\n 'No administratively usable super-administrator exists. The application cannot be '\n + 'administered, and no in-product path can grant the role because every such path '\n + 'requires it. Restore one out-of-band (seed or direct database write) by giving an '\n + 'ACTIVE user one of the conferring roles below.',\n {\n usableSuperAdminCount: population.usableSuperAdminCount,\n requiredUsableSuperAdminCount: SUPER_ADMIN_FLOOR_MINIMUM,\n conferringRoles: population.conferringRoles,\n usableStatuses: [...ADMINISTRATIVELY_USABLE_USER_STATUSES],\n },\n );\n\n await this.auditLogsService?.logApplicationSuperAdminFloorBreached({\n usableSuperAdminCount: population.usableSuperAdminCount,\n requiredUsableSuperAdminCount: SUPER_ADMIN_FLOOR_MINIMUM,\n conferringRoles: population.conferringRoles,\n usableStatuses: [...ADMINISTRATIVELY_USABLE_USER_STATUSES],\n }, executionContext);\n } catch (error) {\n // See the header: a diagnostic must never be the reason startup fails.\n this.logDebug('Super-administrator floor report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * Report — never enforce — the last-organization-owner floor, per tenant.\n *\n * The write guards are the protection; this is the only surface that observes states they never\n * saw (a direct database edit, a restore from a backup taken mid-erasure, a seed that authored no\n * owner, or a role-table reconfiguration that changed which roles confer ownership).\n *\n * NON-FATAL, for the same reason as its application twin and one more of its own: a fresh\n * deployment legitimately has zero organizations, and a tenant left ownerless by an out-of-band\n * edit is a condition to report, not a reason to refuse to serve every OTHER tenant.\n *\n * Cost is three queries regardless of tenant count — see\n * {@link measureOrganizationsMissingUsableOwner}. The breached list is logged in full because an\n * operator cannot act on a count, but it is the ONLY thing that scales with the breach, not with\n * the tenant base.\n */\n protected async reportOrganizationOwnerFloor(): Promise<void> {\n // Platform mode runs no tenant population — there is no floor to measure.\n if (this.isPlatformMode) return;\n /**\n * ONLY the runtime that owns the application's administrative population.\n *\n * The report reads `users` and `organizations` across the whole application. A confined\n * runtime (minion/worker) holds table-scoped grants covering neither, so it cannot perform\n * the read — and has no accountability for the answer even if it could. Observed on a\n * clean-room PostgreSQL boot (2026-08-24): the marketing-scrapper minion produced\n * `permission denied for table users` and `for table organizations` on every startup.\n *\n * It never blocked anything — the report is non-fatal by design — which is precisely why it\n * lasted: a recurring, ignorable error inside an otherwise healthy boot. The application\n * backend still runs both reports, so no observation is lost.\n */\n if (!resolveApplicationRuntimeProfileBootAssertions(this.resolvedRuntimeProfile).reportsAdministrativeContinuityFloors) return;\n\n try {\n if (!this.repositoriesRegistryService.getRepository(CoreResourceType.ORGANIZATIONS)\n || !this.repositoriesRegistryService.getRepository(CoreResourceType.ORGANIZATION_MEMBERS)) {\n this.logDebug('Skipping the organization-owner floor report: organization repositories are not registered');\n return;\n }\n\n const authExecutionContextFactory = this.authExecutionContextFactory;\n if (!authExecutionContextFactory) {\n this.logDebug('Skipping the organization-owner floor report: the auth execution-context factory is not bound');\n return;\n }\n\n const population = await measureOrganizationsMissingUsableOwner({\n // The report builds its OWN system context from this factory. It is a whole-estate\n // backstop and must NOT trust a caller-supplied context: a role-less or wrong-execution-\n // type context silently confined the ORGANIZATIONS scope-root read to the empty set and\n // the backstop then reported a healthy estate. See the block comment in\n // `measureOrganizationsMissingUsableOwner`.\n authExecutionContextFactory,\n repositoriesRegistry: this.repositoriesRegistryService,\n errorBuilder: this.errorBuilder,\n conferringRoles: resolveOrganizationOwnerConferringRoles(this.authorizationsService),\n });\n\n // The PREVENTIVE half, and the only one this floor has. A tenant with exactly one usable\n // owner is a single resignation or suspension away from being unadministrable, and it is\n // the population the floor will REFUSE to help — every removal there answers 409 until a\n // second owner exists. WARN, not error: nothing is broken yet, and an error here on a\n // legitimately small tenant would train operators to ignore the channel.\n if (population.singleOwnerOrganizations.length > 0) {\n this.logger.warn(\n 'Organizations have exactly ONE administratively usable owner. Each is one lifecycle '\n + 'event away from being unadministrable, and the owner floor will refuse every removal '\n + 'there until a second owner is granted. Recommend at least two owners per tenant.',\n {\n singleOwnerOrganizationCount: population.singleOwnerOrganizations.length,\n singleOwnerOrganizations: population.singleOwnerOrganizations,\n protectedOrganizationCount: population.protectedOrganizationCount,\n },\n );\n }\n\n if (population.ownerlessOrganizations.length === 0) {\n this.logDebug('Organization-owner floor satisfied for every protected tenant', {\n protectedOrganizationCount: population.protectedOrganizationCount,\n });\n return;\n }\n\n // ERROR, not warn: these tenants cannot administer THEMSELVES, and no member of them can\n // fix it — granting ownership requires the authority they just lost. Recovery exists but\n // is an out-of-tenant operator action, so the log names it rather than leaving the reader\n // to discover there is one. (Until 2026-08-05 this said no in-product path existed at all;\n // `organizationMembers.grantOwnership` is that path.)\n this.logger.error(\n 'Organizations exist with no administratively usable owner. They cannot administer '\n + 'themselves, and no member of them can repair it — granting ownership requires the '\n + 'authority that was lost. Repair from the platform tier with '\n + '`organizationMembers.grantOwnership`, which promotes an EXISTING member of the tenant '\n + 'and requires APP_ADMIN_SUPER_ADMIN. Failing that, restore out-of-band by giving an '\n + 'ACTIVE member an ACTIVE membership with a conferring role.',\n {\n ownerlessOrganizationCount: population.ownerlessOrganizations.length,\n protectedOrganizationCount: population.protectedOrganizationCount,\n ownerlessOrganizations: population.ownerlessOrganizations,\n requiredUsableOwners: ORGANIZATION_OWNER_FLOOR_MINIMUM,\n conferringRoles: resolveOrganizationOwnerConferringRoles(this.authorizationsService),\n usableMembershipStatuses: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES],\n usableOwnerUserStatuses: [...ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES],\n },\n );\n\n /*\n * An AUDIT ROW per stranded tenant, beside the log line — the half this report was missing.\n *\n * The APPLICATION twin above has emitted `logApplicationSuperAdminFloorBreached` from the\n * start, and the sibling that watches ALLOWED lifecycle writes emits the organization event\n * per stranded tenant with the reasoning stated at its call site: a log line is not\n * queryable evidence and never reaches a SIEM. This report — the only surface that observes\n * a tenant stranded by a route no guard ever saw — wrote log lines and nothing else, so the\n * breach with the WORST provenance was the one with no trail.\n *\n * `detectedBy: BOOT_REPORT` is what a reader needs and cannot infer: it separates \"a guarded\n * write let this through\" from \"we found it already broken\". The action fields are omitted\n * rather than filled, because there is no action to name.\n *\n * One row per tenant, matching the sibling: an operator who learns about them one at a time\n * cannot plan the remediation. Each is awaited but individually guarded — a failing audit\n * write must not cost the remaining tenants their rows, and must never be why startup fails.\n */\n for (const stranded of population.ownerlessOrganizations) {\n try {\n await this.auditLogsService?.logOrganizationOwnerFloorBreached({\n organizationId: stranded.organizationId,\n detectedBy: AdministrativeContinuityBreachDetection.BOOT_REPORT,\n remainingUsableOwners: 0,\n // The boot report is the application observing its own state: SYSTEM (#1595).\n }, undefined, SYSTEM_AUDIT_PRINCIPAL);\n } catch (error) {\n this.logDebug(\n 'Organization-owner floor breach could not be recorded in the audit trail',\n projectCaughtErrorLogFields(error),\n );\n }\n }\n } catch (error) {\n // See the header: a diagnostic must never be the reason startup fails.\n this.logDebug('Organization-owner floor report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * Report — never enforce — the state of the APPLICATION-OWNER organization (#1054).\n *\n * An application whose declaration marks one organization type with `ownsApplication` must have\n * exactly one organization of it. This says so at boot, at a moment an operator is present, and\n * decides nothing.\n *\n * ## Why it exists when three write guards already do\n *\n * Every door that could produce a second owner organization is shut: all three service-tier CREATE\n * variants refuse the owner type BY DOOR, and `promoteToOwnerOrganization` refuses when one\n * exists and serializes against a concurrent promotion. So the only remaining producers are\n * outside the product entirely — a direct database edit, a restore from a mid-migration backup, a\n * seed written before the marker was declared. This is the one surface that observes a state no\n * write guard ever evaluated, which is exactly the argument the owner-floor report makes for\n * itself two methods above.\n *\n * ## Three findings, three severities, and the zero case is deliberately not one\n *\n * - **Several owner organizations** — ERROR. Everything that resolves through the marker is\n * currently answering nothing (the resolver refuses to CHOOSE, by design), so the application is\n * operating with no owner at all until an operator leaves exactly one.\n * - **None yet** — WARN. On a fresh installation this is the ordinary state until the platform\n * seeds the first administrator's organization, and an ERROR there would train an operator to\n * ignore the channel on every first boot of every correct application.\n * - **No marked type** — SILENT. Most applications are sold to many tenants and no organization\n * operates them; saying so on every boot would be noise about the default.\n *\n * ## Why it inherits both gates, contrary to the plan's R20\n *\n * R20 asked that this report NOT inherit `isPlatformMode` and the runtime-profile flag. Re-reading\n * what each measures says otherwise, and the deviation is recorded rather than silent:\n *\n * - `isPlatformMode` — the platform declares one organization type (`platform-operator`) and it\n * carries no marker, by construction and by pin. The report could only ever find \"not declared\"\n * and return, so the gate costs nothing and saves two reads during platform boot.\n * - the runtime profile — this reads `organizations` application-wide, and a confined runtime\n * (minion/worker) holds no grant over that table. That is measured, not assumed: on a clean-room\n * PostgreSQL boot the marketing-scrapper minion produced `permission denied for table\n * organizations` on every startup. The application backend still runs the report, so no\n * observation is lost — only the recurring, ignorable error inside an otherwise healthy boot.\n *\n * NON-FATAL, like its two neighbours: a diagnostic must never be why startup fails.\n */\n protected async reportApplicationOwnerOrganization(): Promise<void> {\n if (this.isPlatformMode) return;\n if (!resolveApplicationRuntimeProfileBootAssertions(this.resolvedRuntimeProfile).reportsAdministrativeContinuityFloors) return;\n\n try {\n if (!this.repositoriesRegistryService.getRepository(CoreResourceType.ORGANIZATIONS)) {\n this.logDebug('Skipping the application-owner organization report: no organizations repository is registered');\n return;\n }\n\n const resolver = this.applicationOwnerOrganizationResolver;\n if (!resolver) {\n this.logDebug('Skipping the application-owner organization report: the resolver is not bound');\n return;\n }\n const ownerType = resolver.resolveOwnerOrganizationType();\n if (!ownerType) return; // No marked type: the default shape, and nothing to say about it.\n\n const resolution = await resolver.resolve();\n if (resolution.owner) {\n this.logDebug('Application-owner organization resolved', {\n organizationId: resolution.owner.organizationId,\n organizationType: resolution.owner.organizationType,\n });\n return;\n }\n\n if (resolution.absence === ApplicationOwnerOrganizationAbsence.SEVERAL) {\n this.logger.error(\n 'Several organizations carry the type that declares `ownsApplication`. Exactly one organization may '\n + 'operate the application, and until an operator leaves one the framework refuses to choose — so '\n + 'everything that resolves through the owner organization is currently answering nothing. No engine '\n + 'service-tier door can produce this state; repair the rows directly, leaving exactly one.',\n {\n ownerOrganizationType: ownerType,\n // The ids, not just the count — an operator cannot act on a number, and this is the\n // whole population that needs repairing. The report carries them itself rather than\n // leaving them on the resolver's separate WARN, which a log filter can easily miss.\n organizationIds: resolution.duplicateOrganizationIds ?? [],\n },\n );\n return;\n }\n\n this.logger.warn(\n 'An organization type declares `ownsApplication` and no organization carries it, so this application has '\n + 'no owner organization. On a fresh installation the platform seeds it with the first administrator; on '\n + 'an existing one, promote an ACTIVE organization with `organizations.promoteToOwnerOrganization`.',\n { ownerOrganizationType: ownerType, absence: resolution.absence },\n );\n } catch (error) {\n // See the header: a diagnostic must never be the reason startup fails.\n this.logDebug('Application-owner organization report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * WHO holds privileged access right now, at both scopes — the review's raw material (#202).\n *\n * assurance-control: WILDO.ACCESS.PRIVILEGED_REVIEW — surface the privileged-access population at\n * a moment an operator is present, so a periodic review has an explicitly scoped list to decide\n * over.\n *\n * ## Why it reports the SHAPE and not the roster\n *\n * The roster is what a reviewer needs and a boot log is the wrong place to put it: it would be\n * per-principal lines on every restart, unread, and it would put administrator identities into a\n * log stream that has no reason to hold them. What the log CAN carry is the size and the axes —\n * how many at each scope, which roles confer it, and which tenants could not be read — which is\n * enough to notice that the population moved and to know a review is due. The roster stays one\n * call away in `enumeratePrivilegedAccessPopulation`.\n *\n * ## Why it is not a review\n *\n * Nothing here schedules, decides or records an outcome. The occurrence record is the\n * application's to supply as a declared host artifact\n * (`PRIVILEGED_ACCESS_REVIEW_HOST_RECORD_ARTIFACT_KIND_REF`), because Wildo cannot witness a human\n * review — and a boot line that read as one would be the framework asserting a decision nobody\n * made.\n *\n * NON-FATAL and gated exactly like the two floors above: a confined runtime holds no grant over\n * `users` or `organizations`, and a diagnostic must never be why startup fails.\n */\n protected async reportPrivilegedAccessPopulation(): Promise<void> {\n if (this.isPlatformMode) return;\n if (!resolveApplicationRuntimeProfileBootAssertions(this.resolvedRuntimeProfile).reportsAdministrativeContinuityFloors) return;\n\n try {\n if (!this.repositoriesRegistryService.getRepository(CoreResourceType.USERS)) {\n this.logDebug('Skipping the privileged-access population report: no users repository is registered');\n return;\n }\n const authExecutionContextFactory = this.authExecutionContextFactory;\n if (!authExecutionContextFactory) {\n this.logDebug('Skipping the privileged-access population report: the auth execution-context factory is not bound');\n return;\n }\n\n const population = await enumeratePrivilegedAccessPopulation({\n authExecutionContextFactory,\n repositoriesRegistry: this.repositoriesRegistryService,\n errorBuilder: this.errorBuilder,\n applicationScopeConferringRoles: resolveSuperAdminConferringRoles(this.authorizationsService),\n organizationScopeConferringRoles: resolveOrganizationOwnerConferringRoles(this.authorizationsService),\n // Supplied, never read inside the enumeration — see its `observedAt` doc.\n observedAt: new Date().toISOString(),\n });\n\n this.logDebug('Privileged-access population observed', {\n observedAt: population.observedAt,\n applicationScopeHolderCount: population.applicationScopeHolders.length,\n organizationScopeHolderCount: population.organizationScopeHolders.length,\n applicationScopeConferringRoles: population.applicationScopeConferringRoles,\n organizationScopeConferringRoles: population.organizationScopeConferringRoles,\n });\n\n // WARN and separate, because it is the only part a reader must act on: a tenant the\n // enumeration could not read is absent from the population, and an absent tenant looks\n // exactly like one with no privileged access — the wrong direction to be wrong in.\n if (population.unreadableOrganizationIds.length > 0) {\n this.logger.warn(\n 'The privileged-access enumeration could not read the memberships of some tenants. Those tenants are '\n + 'ABSENT from the population, which is indistinguishable from having no privileged access — treat a '\n + 'review taken now as incomplete for them.',\n { unreadableOrganizationIds: population.unreadableOrganizationIds },\n );\n }\n } catch (error) {\n this.logDebug('Privileged-access population report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * WHICH stored provider credentials sit under a slot name their provider no longer declares (#624).\n *\n * ## What it reports, and why it only reports\n *\n * A credential row is keyed `(owner, connectionRef, secretSlug)` (#1670) and classified here by the `providerRef`\n * that created it, whose secrets contract the slot belongs to; every lookup asks for the provider's\n * secrets-contract KEY, and a row keyed on anything else — the env-var spelling rows carried before\n * the store was keyed on the key, or a spelling a regeneration renamed — is present, enabled,\n * correctly sealed and unreachable. The refusal at read time now says so; this is the half that\n * finds the population before anybody tries to use one.\n *\n * It never repairs. The seal binds the slot name, so the row cannot be renamed, and re-sealing it\n * is a migration machine the project decided not to build (2026-09-12). The remedy is reconnecting,\n * which is a person's act, not a boot step's.\n *\n * ## WARN, counts only, and two lines rather than one\n *\n * WARN: nothing is broken for anyone who has not tried to use the credential, and the connections\n * are recoverable. Counts per provider and slot, never an owner id — an operator acts on \"asana has\n * two organization rows under `ASANA_API_KEY`\", and a boot log has no reason to hold tenant or\n * person identifiers. A provider that is not registered at all is its OWN line: its remedy is the\n * provider module, and reconnecting to a provider the application no longer carries is impossible.\n *\n * NON-FATAL and gated like the reports above: a confined runtime holds no grant over these tables,\n * and a diagnostic must never be why startup fails.\n */\n protected async reportStoredProviderCredentialSlots(systemAccess: SystemAccessBackendService | undefined): Promise<void> {\n if (this.isPlatformMode) return;\n if (!resolveApplicationRuntimeProfileBootAssertions(this.resolvedRuntimeProfile).reportsStoredProviderCredentialSlots) return;\n\n try {\n if (!systemAccess) {\n this.logDebug('Skipping the stored provider credential slot report: no system access service is bound');\n return;\n }\n\n const report = await measureStoredProviderCredentialSlots({\n systemAccess,\n registry: this.externalProvidersRegistryService,\n isReadable: (resourceType) => Boolean(this.repositoriesRegistryService.getRepository(resourceType)),\n });\n\n if (report.retiredSlots.length > 0) {\n this.logger.warn(\n 'Stored provider credentials sit under a slot name their provider no longer declares, so no lookup under '\n + 'the current contract reaches them: a call that asks to act as one of those owners is refused rather than '\n + 'served from them. They cannot be renamed — the seal binds the '\n + 'slot name — and nothing repairs them automatically. Each affected organization or person must '\n + 'reconnect the account (or re-enter the credential), which stores it under the current slot. '\n + 'Reconnecting does not remove the retired row: it stays behind as inert residue, and this line keeps '\n + 'counting it until the row is deleted.',\n {\n retiredSlotRowCount: report.retiredSlots.reduce((total, finding) => total + finding.rowCount, 0),\n retiredSlots: report.retiredSlots,\n inspectedRowCount: report.inspectedRowCount,\n },\n );\n }\n\n if (report.unregisteredProviders.length > 0) {\n this.logger.warn(\n 'Stored provider credentials belong to providers this runtime does not register at all, so they cannot be '\n + 'judged or used. Restore the provider module if the integration is still wanted; otherwise the rows are '\n + 'residue of a removed provider.',\n {\n unregisteredProviderRowCount: report.unregisteredProviders.reduce((total, finding) => total + finding.rowCount, 0),\n unregisteredProviders: report.unregisteredProviders,\n inspectedRowCount: report.inspectedRowCount,\n },\n );\n }\n\n if (report.retiredSlots.length === 0 && report.unregisteredProviders.length === 0) {\n this.logDebug('Every stored provider credential is under a slot its provider currently declares', {\n inspectedRowCount: report.inspectedRowCount,\n });\n }\n } catch (error) {\n this.logDebug('Stored provider credential slot report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * WHICH of the application's own resources have never been asked whether they hold personal data.\n *\n * ## Why this reports and does not refuse — the decision, not an omission\n *\n * Issue #93 asked whether a resource holding personal data should be REQUIRED to declare it, and\n * the evidence for requiring it was strong. Measured across two applications, a declaration gets\n * made if and only if the framework refuses to start without it: `exportSubject` is fail-closed at\n * registration and was declared on 10 of 12 resources, while `retentionPolicy` and\n * `.impersonalizeWith()` are unenforced and were declared on 1 and 0.\n *\n * Paul decided against refusing: a hard constraint on every author, for every resource, forever is\n * too strict, and it is the shape `application-creation-directive.md` warns about — the system must\n * work first, with protection arriving as a judge-style guard rather than a refusal wired into the\n * mechanism. So the log line is the whole enforcement here, and the half that actually produces\n * declarations is the framework knowledge that teaches an author to write one while authoring the\n * resource, where it costs a line.\n *\n * ## WARN, and the wording matters more than the level\n *\n * This reports \"unanswered\", never \"undeclared personal data\". Most resources genuinely hold none,\n * and a report that implied otherwise would be wrong about the majority of its own findings — which\n * is precisely how a diagnostic channel trains its readers to skim. ERROR is reserved for the two\n * administrative floors above, where something IS broken.\n *\n * ## Application resources only\n *\n * The engine declares its own posture across ~85 resources and an application author cannot change\n * any of them. `applicationResourceTypes` comes from the registry, which records the split at the\n * one point where the app and core factory maps are still distinguishable.\n */\n private reportApplicationPersonalDataDeclarations(): void {\n try {\n const registry = this.resourcesRegistryService?.getResourcesRegistry();\n if (!registry) {\n this.logDebug('Skipping the personal-data declaration report: the resources registry is not available');\n return;\n }\n\n const unanswered = collectApplicationResourcesWithNoPersonalDataDeclaration({\n resourceConfigurations: registry.resourceConfigurations as unknown as Record<string, PersonalDataDeclarationSubject>,\n applicationResourceTypes: registry.applicationResourceTypes,\n });\n\n if (unanswered.length === 0) {\n this.logDebug('Every application resource has answered the personal-data question', {\n applicationResourceCount: registry.applicationResourceTypes.length,\n });\n return;\n }\n\n this.logger.warn(\n 'Application resources have said NOTHING about whether their rows are about people. This is '\n + 'not a claim that they hold personal data — most resources do not — it is that the question '\n + 'is unanswered, so a generated privacy notice can say nothing about them and an erasure '\n + 'request has no instruction for them. Answer it on the resource configuration with any of: '\n + '`retentionPolicy` (RETAIN_ONLY is the checked way to say \"holds no personal data of its '\n + 'own\"), `dataSubjectPolicy`, `systemAccessPolicy.exportSubject`, or a `.dataCategories()` '\n + 'declaration on the fields that hold it.',\n {\n unansweredResourceCount: unanswered.length,\n applicationResourceCount: registry.applicationResourceTypes.length,\n unansweredResources: unanswered,\n },\n );\n } catch (error) {\n // A diagnostic must never be the reason startup fails — the same contract as the two floors.\n this.logDebug('Personal-data declaration report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * Validate that all components are properly initialized\n */\n private async validateInitialization(options: { headlessMode?: boolean } = {}): Promise<void> {\n this.logDebug('Validating application initialization...');\n\n try {\n // Validate app config is accessible\n if (!this.isPlatformMode) {\n const config = this.appConfigService.config;\n if (!config) {\n const error = this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {customMessageReference: ErrorCustomMessageReference.START_APPLICATION_CONFIGURATION_FAILED}\n );\n throw error;\n }\n }\n\n // Validate resources registry is accessible\n const registry = this.resourcesRegistryService.getResourcesRegistry();\n if (!registry) {\n const error = this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {customMessageReference: ErrorCustomMessageReference.START_APPLICATION_INITIALIZATION_FAILED}\n );\n throw error;\n }\n\n // Validate repositories registry is accessible\n // const repositoriesDebugInfo = this.repositoriesRegistryService.getDebugInfo();\n // if (!repositoriesDebugInfo.isInitialized) {\n // throw new Error('Repositories registry is not initialized');\n // }\n\n // Validate services registry is accessible\n // const servicesDebugInfo = this.servicesRegistryService.getDebugInfo();\n // if (!servicesDebugInfo.isInitialized) {\n // throw new Error('Services registry is not initialized');\n // }\n\n // Validate controllers registry is accessible\n // const controllersDebugInfo = this.controllersRegistryService.getDebugInfo();\n // if (!controllersDebugInfo.isInitialized) {\n // throw new Error('Controllers registry is not initialized');\n // }\n\n // // Validate HTTP server is running\n // if (!this.httpServerService.isRunning()) {\n // throw new Error('HTTP server is not running');\n // }\n\n const serverInfo = options.headlessMode\n ? undefined\n : this.httpServerService.getServerInfo();\n\n // this.logDebug('Application initialization validation successful', {\n // appName: config.appIdentity.appName,\n // environment: process.env.APPLICATION_ENV,\n // resourcesCount: Object.keys(registry.resourceConfigurations).length,\n // repositoriesCount: repositoriesDebugInfo.repositoryCount,\n // repositoriesOperationPaths: repositoriesDebugInfo.operationPathsCount,\n // servicesCount: servicesDebugInfo.serviceCount,\n // servicesOperationPaths: servicesDebugInfo.operationPathsCount,\n // controllersCount: controllersDebugInfo.controllerCount,\n // controllersOperationPaths: controllersDebugInfo.operationPathsCount,\n // totalRoutes: controllersDebugInfo.totalRoutes,\n // httpServerRunning: this.httpServerService.isRunning(),\n // serverHost: serverInfo?.host,\n // serverPort: serverInfo?.port\n // });\n\n } catch (error) {\n // Validation failure ownership stays with the terminal runtime host.\n throw error;\n }\n }\n\n /**\n * Ensure the application is initialized before operations\n */\n private ensureInitialized(): void {\n if (!this.isInitialized) {\n const error = this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.START_APPLICATION_STARTUP_FAILED }\n );\n throw error;\n }\n }\n\n protected shouldInitializeHttpServer(options: { headlessMode?: boolean }): boolean {\n return !this.isPlatformMode && !options.headlessMode;\n }\n\n protected shouldSyncCronJobs(options: { skipCronSync?: boolean }): boolean {\n return !this.isPlatformMode && !options.skipCronSync;\n }\n\n private rebindServicesRegistryForRuntime(container: any, registry: ServicesRegistryHandlerBackendService): void {\n if (!container || typeof container.rebind !== 'function') {\n return;\n }\n container.rebind(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService).toConstantValue(registry);\n }\n}\n\n/**\n * `listAsSystem` returns either a bare array or a paginated envelope depending on whether the caller\n * asked for pagination. The erasure effect's reads never paginate, but narrowing by CAST would be a\n * lie that survives until the day someone adds a pagination argument — normalise instead.\n */\nfunction normalizeSystemListResult<T>(result: T[] | { data?: T[]; items?: T[] }): T[] {\n if (Array.isArray(result)) return result;\n return result?.data ?? result?.items ?? [];\n}\n\n"]}
1
+ {"version":3,"file":"start-application.backend.service.js","sourceRoot":"","sources":["../../../../../src/runtime/services/start-application.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sCAAsC,EAAE,MAAM,2FAA2F,CAAC;AACnJ,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAKzD,OAAO,EAAE,wCAAwC,EAAE,2BAA2B,EAAE,MAAM,kFAAkF,CAAC;AACzK,OAAO,EAAE,uCAAuC,EAAE,MAAM,kFAAkF,CAAC;AAC3I,OAAO,EAAE,kCAAkC,EAAE,MAAM,iEAAiE,CAAC;AAKrH,OAAO,EACH,iCAAiC,EACjC,uCAAuC,GAC1C,MAAM,4EAA4E,CAAC;AAEpF,OAAO,EAAE,uCAAuC,EAAE,MAAM,sFAAsF,CAAC;AAC/I,OAAO,EAAE,uCAAuC,EAAE,SAAS,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,cAAc,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,cAAc,EAAE,cAAc,EAAE,2CAA2C,EACrU,wCAAwC,EAAE,4CAA4C,EAAE,kBAAkB,EAAE,qCAAqC,EAAE,sCAAsC,EAAE,8BAA8B,EAAE,sCAAsC,EAAE,0CAA0C,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnc,OAAO,EAAE,wDAAwD,EAAuC,MAAM,uBAAuB,CAAC;AACtI,OAAO,EAAE,2CAA2C,EAAuC,MAAM,uBAAuB,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAEhJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,4EAA4E,CAAC;AACpH,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4EAA4E,CAAC;AACpF,OAAO,EACL,oDAAoD,EACpD,2CAA2C,EAC3C,sCAAsC,EACtC,gCAAgC,EAChC,uCAAuC,GACxC,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,mCAAmC,EAAE,MAAM,mFAAmF,CAAC;AACxI,OAAO,EAAE,yBAAyB,EAAE,8CAA8C,EAAE,MAAM,yEAAyE,CAAC;AACpK,OAAO,EACL,mCAAmC,GAEpC,MAAM,mGAAmG,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,sBAAsB,EAAE,MAAM,6EAA6E,CAAC;AACrH,OAAO,EAAE,+BAA+B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,wCAAwC,EAAE,MAAM,yFAAyF,CAAC;AACnJ,OAAO,EAAE,2BAA2B,EAAE,MAAM,oFAAoF,CAAC;AAIjI,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAG3H,OAAO,EAAE,qCAAqC,EAAE,MAAM,0FAA0F,CAAC;AACjJ,OAAO,EAAE,8BAA8B,EAAE,MAAM,wFAAwF,CAAC;AACxI,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,uCAAuC,EAAE,MAAM,kFAAkF,CAAC;AAC3I,OAAO,EAAE,yCAAyC,EAAE,MAAM,oFAAoF,CAAC;AAC/I,OAAO,EAAE,wCAAwC,EAAE,MAAM,mFAAmF,CAAC;AAK7I,OAAO,EAAE,gCAAgC,EAAE,MAAM,0EAA0E,CAAC;AAC5H,OAAO,EAAE,wCAAwC,EAAE,MAAM,+EAA+E,CAAC;AACzI,OAAO,EAAE,4BAA4B,EAAE,MAAM,8EAA8E,CAAC;AAC5H,OAAO,EAAE,oCAAoC,EAAE,MAAM,4FAA4F,CAAC;AAClJ,OAAO,EAAE,2CAA2C,EAAE,MAAM,qGAAqG,CAAC;AAClK,OAAO,EAAE,gCAAgC,EAAE,MAAM,wFAAwF,CAAC;AAC1I,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAAE,6CAA6C,EAAE,MAAM,oFAAoF,CAAC;AACnJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACpJ,OAAO,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAE7J,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AAClI,OAAO,EAAE,sCAAsC,EAAE,MAAM,4FAA4F,CAAC;AAEpJ,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,2DAA2D,EAAE,MAAM,qHAAqH,CAAC;AAClM,OAAO,EAAE,2CAA2C,EAAE,MAAM,uFAAuF,CAAC;AACpJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,kCAAkC,EAAE,MAAM,uGAAuG,CAAC;AAC3J,OAAO,EAAE,kDAAkD,EAAE,MAAM,2GAA2G,CAAC;AAC/K,OAAO,EAAE,+CAA+C,EAAE,MAAM,sGAAsG,CAAC;AACvK,OAAO,EAAE,gCAAgC,EAAE,MAAM,4FAA4F,CAAC;AAC9I,OAAO,EAAE,mCAAmC,EAAE,MAAM,2FAA2F,CAAC;AAChJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,uFAAuF,CAAC;AACzI,OAAO,EAAE,+BAA+B,EAAE,MAAM,sFAAsF,CAAC;AACvI,OAAO,EAAE,+BAA+B,EAAE,kCAAkC,EAAE,MAAM,yFAAyF,CAAC;AAC9K,OAAO,EAAE,kCAAkC,EAAE,MAAM,qGAAqG,CAAC;AACzJ,OAAO,EAAE,iCAAiC,EAAE,MAAM,iGAAiG,CAAC;AACpJ,OAAO,EAAE,4CAA4C,EAAE,MAAM,qGAAqG,CAAC;AACnK,OAAO,EAAE,gCAAgC,EAAE,MAAM,gGAAgG,CAAC;AAClJ,OAAO,EAAE,qBAAqB,EAAE,MAAM,sEAAsE,CAAC;AAC7G,OAAO,EAAE,gCAAgC,EAAE,MAAM,iFAAiF,CAAC;AACnI,OAAO,EAAE,mCAAmC,EAAE,MAAM,sFAAsF,CAAC;AAC3I,OAAO,EAAE,8CAA8C,EAAE,MAAM,iGAAiG,CAAC;AAEjK,OAAO,EAAE,sCAAsC,EAAE,MAAM,sGAAsG,CAAC;AAC9J,OAAO,EAAE,iCAAiC,EAAE,MAAM,iGAAiG,CAAC;AACpJ,OAAO,EAAE,8BAA8B,EAAE,sCAAsC,EAAE,MAAM,8FAA8F,CAAC;AACtL,OAAO,EAAE,4BAA4B,EAAE,MAAM,mFAAmF,CAAC;AACjI,OAAO,EAAE,+BAA+B,EAAE,MAAM,uFAAuF,CAAC;AACxI,OAAO,EAAE,sCAAsC,EAAE,MAAM,gFAAgF,CAAC;AACxI,OAAO,EAAE,qBAAqB,EAAE,MAAM,wFAAwF,CAAC;AAC/H,OAAO,EAAE,8BAA8B,EAAE,MAAM,uGAAuG,CAAC;AACvJ,OAAO,EAAE,mCAAmC,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAClK,OAAO,EAAE,8BAA8B,EAA6C,MAAM,8EAA8E,CAAC;AAGzK,OAAO,EAAE,uBAAuB,EAAkC,MAAM,+EAA+E,CAAC;AAGxJ,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,wEAAwE,CAAC;AACrL,OAAO,EAAE,qCAAqC,EAAE,MAAM,6EAA6E,CAAC;AAGpI,OAAO,EAAE,wCAAwC,EAAE,MAAM,0EAA0E,CAAC;AACpI,OAAO,EAAE,iDAAiD,EAAE,MAAM,yFAAyF,CAAC;AAC5J,OAAO,EAAE,2BAA2B,EAAE,MAAM,qFAAqF,CAAC;AAClI,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,8FAA8F,CAAC;AAC7I,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AACnJ,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,mCAAmC,EAAE,mCAAmC,EAAE,qCAAqC,EAAE,MAAM,sGAAsG,CAAC;AACvO,OAAO,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACrJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,6EAA6E,CAAC;AAEzH,sGAAsG;AACtG,2FAA2F;AAC3F,qEAAqE;AACrE,OAAO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,iCAAiC,EACjC,gCAAgC,EAChC,8CAA8C,EAC9C,iCAAiC,EACjC,qBAAqB,EACrB,gCAAgC,EAChC,qCAAqC,EACrC,gDAAgD,EAChD,uCAAuC,EACvC,wCAAwC,EACxC,6CAA6C,EAC7C,8CAA8C,EAC9C,mDAAmD,EACnD,+BAA+B,EAC/B,iCAAiC,EACjC,4BAA4B,EAC5B,mCAAmC,EACnC,oDAAoD,EACpD,mDAAmD,EACnD,kCAAkC,EAClC,kCAAkC,EAClC,sCAAsC,EACtC,yCAAyC,EACzC,8CAA8C,EAC9C,4BAA4B,EAC5B,kCAAkC,EAClC,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,mCAAmC,EACnC,4BAA4B,EAC5B,6BAA6B,EAC7B,8BAA8B,EAC9B,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,EAC/B,6BAA6B,EAC7B,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,6BAA6B,GAC9B,MAAM,gFAAgF,CAAC;AACxF,OAAO,EAAE,iCAAiC,EAAE,MAAM,+EAA+E,CAAC;AAClI,OAAO,EAAE,4BAA4B,EAAE,MAAM,0EAA0E,CAAC;AAGxH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAmB,MAAM,uDAAuD,CAAC;AAC5G,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,gCAAgC,EAAE,MAAM,gFAAgF,CAAC;AAGlI,OAAO,EAAE,yCAAyC,EAAE,MAAM,0FAA0F,CAAC;AACrJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,mEAAmE,CAAC;AACzH,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAInG,OAAO,EACH,iCAAiC,EACjC,8BAA8B,GACjC,MAAM,wFAAwF,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,mFAAmF,CAAC;AAE9H,OAAO,EAAE,oCAAoC,EAAE,MAAM,4FAA4F,CAAC;AAElJ,OAAO,EAAE,sCAAsC,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,wFAAwF,CAAC;AAEnQ,OAAO,EAAE,qDAAqD,EAAE,MAAM,uHAAuH,CAAC;AAC9L,OAAO,EAAE,6CAA6C,EAAE,MAAM,+GAA+G,CAAC;AAC9K,OAAO,EAAE,sCAAsC,EAAsD,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAG/K,OAAO,EAAE,qBAAqB,EAAE,MAAM,sFAAsF,CAAC;AAC7H,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AACzJ,OAAO,EAAE,uCAAuC,EAAE,MAAM,2FAA2F,CAAC;AACpJ,OAAO,EAAE,qCAAqC,EAAE,MAAM,sFAAsF,CAAC;AAC7I,OAAO,EAAE,mCAAmC,EAAE,MAAM,iFAAiF,CAAC;AAItI,OAAO,EAAE,2BAA2B,EAAE,MAAM,mEAAmE,CAAC;AAChH,OAAO,EAAE,sCAAsC,EAAE,MAAM,iFAAiF,CAAC;AACzI,OAAO,EAAE,8BAA8B,EAAE,MAAM,6EAA6E,CAAC;AAC7H,OAAO,EAAE,gCAAgC,EAAE,MAAM,+EAA+E,CAAC;AAGjI,OAAO,EAAE,mCAAmC,EAAE,MAAM,yFAAyF,CAAC;AAG9I,OAAO,EAAE,yCAAyC,EAAE,MAAM,uFAAuF,CAAC;AAClJ,OAAO,EAAE,kCAAkC,EAAE,MAAM,kFAAkF,CAAC;AAgQtI;;;;;;;;;;;;;;GAcG;AAEH,wHAAwH;AACxH;;;;;;;;;;;;;;;GAeG;AACH,IAAK,sCAmCJ;AAnCD,WAAK,sCAAsC;IACvC,oEAAoE;IACpE,mFAAyC,CAAA;IACzC;;;;;;;;;;;;;OAaG;IACH,iHAAuE,CAAA;IACvE,gFAAgF;IAChF,iFAAuC,CAAA;IACvC,4EAA4E;IAC5E,2EAAiC,CAAA;IACjC;;;;;;;;;OASG;IACH,mGAAyD,CAAA;IACzD,2EAA2E;IAC3E,+EAAqC,CAAA;AACzC,CAAC,EAnCI,sCAAsC,KAAtC,sCAAsC,QAmC1C;AAoBD;;;;;;;;;;GAUG;AACH,SAAS,wCAAwC,CAC7C,MAA8C,EAC9C,aAAmC,EACnC,MAAe;IAEf,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,IAAI,SAAS,CAAC;IAC3D,MAAM,MAAM,GAAG,yEAAyE,CAAC;IACzF,MAAM,WAAW,GAAG,iEAAiE,CAAC;IAEtF,QAAQ,MAAM,EAAE,CAAC;QACb,KAAK,sCAAsC,CAAC,kBAAkB;YAC1D,OAAO,GAAG,MAAM,iEAAiE;kBAC3E,sEAAsE,WAAW,EAAE,CAAC;QAE9F,KAAK,sCAAsC,CAAC,iCAAiC;YACzE,OAAO,GAAG,MAAM,iBAAiB,WAAW,6CAA6C;kBACnF,mFAAmF;kBACnF,0EAA0E,WAAW,IAAI;kBACzF,4FAA4F;kBAC5F,qEAAqE;kBACrE,uFAAuF;kBACvF,wFAAwF;kBACxF,0FAA0F;kBAC1F,GAAG,WAAW,EAAE,CAAC;QAE3B,KAAK,sCAAsC,CAAC,iBAAiB;YACzD,OAAO,GAAG,MAAM,iBAAiB,WAAW,kDAAkD;kBACxF,sFAAsF;kBACtF,0BAA0B,WAAW,EAAE,CAAC;QAElD,KAAK,sCAAsC,CAAC,cAAc;YACtD,OAAO,GAAG,MAAM,iBAAiB,WAAW,4BAA4B;kBAClE,aAAa,MAAM,IAAI,SAAS,qDAAqD;kBACrF,mFAAmF,WAAW,EAAE,CAAC;QAE3G,KAAK,sCAAsC,CAAC,0BAA0B;YAClE,OAAO,GAAG,MAAM,iBAAiB,WAAW,oDAAoD;kBAC1F,2BAA2B,MAAM,IAAI,SAAS,6CAA6C;kBAC3F,+BAA+B,+BAA+B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK;kBAC1F,2FAA2F;kBAC3F,wFAAwF;kBACxF,mDAAmD;kBACnD,2DAA2D,WAAW,EAAE,CAAC;QAEnF,KAAK,sCAAsC,CAAC,gBAAgB;YACxD,OAAO,GAAG,MAAM,iBAAiB,WAAW,yBAAyB;kBAC/D,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,wDAAwD;kBACtF,WAAW,WAAW,EAAE,CAAC;QAEnC,OAAO,CAAC,CAAC,CAAC;YACN,8DAA8D;YAC9D,gEAAgE;YAChE,oBAAoB;YACpB,MAAM,WAAW,GAAU,MAAM,CAAC;YAClC,OAAO,GAAG,MAAM,iBAAiB,WAAW,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,WAAW,EAAE,CAAC;QAC7F,CAAC;IACL,CAAC;AACL,CAAC;AAGM,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAamB;IACU;IACwB;IACjB;IACW;IACb;IACY;IAChB;IACE;IACA;IACE;IACS;IACO;IACe;IACtC;IACF;IACD;IACmB;IACE;IACA;IACL;IACD;IACA;IACG;IACX;IACQ;IACK;IACF;IACX;IACE;IACI;IACH;IACH;IACD;IAKD;IACE;IACQ;IAIG;IAWF;IAKC;IAMzD;IAMA;IAKF;IAIuE;IA7F5F;;;;OAIG;IACK,sBAAsB,GAA8B,yBAAyB,CAAC,mBAAmB,CAAC;IAEhG,QAAQ,CAA+D;IACvE,aAAa,GAAG,KAAK,CAAC;IACxB,cAAc,GAAG,KAAK,CAAC;IAE/B,YAC0D,MAAqB,EACX,gBAAyC,EACjB,iCAA2E,EAC5F,wBAAyD,EAC9C,2BAAsE,EACnF,uBAA8D,EAClD,0BAAoE,EACpF,iBAA2C,EACzC,YAAwC,EACxC,YAAiC,EAC/B,qBAAmD,EAC1C,eAAuD,EAChD,qCAA4E,EAC7D,kBAA+E,EACrH,cAA8B,EAChC,YAA0B,EAC3B,WAA+B,EACZ,8BAAqE,EACnE,gCAAyE,EACzE,gCAAyE,EAC9E,2BAAsE,EACvE,0BAAoE,EACpE,0BAAoE,EACjE,6BAA0E,EACrF,kBAAoD,EAC5C,0BAAsD,EACjD,+BAA8E,EAChF,sBAA4D,EACvE,kBAA6C,EAC3C,oBAAiD,EAC7C,wBAAgE,EACnE,4BAAiE,EACpE,yBAA2D,EAC5D,iBAAkD,EAKnD,uBAAuD,EACrD,yBAA2D,EACnD,0BAA6D,EAI1D,oCAAiF,EAWnF,2BAAyD,EAKxD,gBAA0C,EAMnG,2BAAuE,EAMvE,oCAAyF,EAK3F,uBAA+D,EAIQ,kCAA8E;QAjFhH,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACjB,sCAAiC,GAAjC,iCAAiC,CAA0C;QAC5F,6BAAwB,GAAxB,wBAAwB,CAAiC;QAC9C,gCAA2B,GAA3B,2BAA2B,CAA2C;QACnF,4BAAuB,GAAvB,uBAAuB,CAAuC;QAClD,+BAA0B,GAA1B,0BAA0B,CAA0C;QACpF,sBAAiB,GAAjB,iBAAiB,CAA0B;QACzC,iBAAY,GAAZ,YAAY,CAA4B;QACxC,iBAAY,GAAZ,YAAY,CAAqB;QAC/B,0BAAqB,GAArB,qBAAqB,CAA8B;QAC1C,oBAAe,GAAf,eAAe,CAAwC;QAChD,0CAAqC,GAArC,qCAAqC,CAAuC;QAC7D,uBAAkB,GAAlB,kBAAkB,CAA6D;QACrH,mBAAc,GAAd,cAAc,CAAgB;QAChC,iBAAY,GAAZ,YAAY,CAAc;QAC3B,gBAAW,GAAX,WAAW,CAAoB;QACZ,mCAA8B,GAA9B,8BAA8B,CAAuC;QACnE,qCAAgC,GAAhC,gCAAgC,CAAyC;QACzE,qCAAgC,GAAhC,gCAAgC,CAAyC;QAC9E,gCAA2B,GAA3B,2BAA2B,CAA2C;QACvE,+BAA0B,GAA1B,0BAA0B,CAA0C;QACpE,+BAA0B,GAA1B,0BAA0B,CAA0C;QACjE,kCAA6B,GAA7B,6BAA6B,CAA6C;QACrF,uBAAkB,GAAlB,kBAAkB,CAAkC;QAC5C,+BAA0B,GAA1B,0BAA0B,CAA4B;QACjD,oCAA+B,GAA/B,+BAA+B,CAA+C;QAChF,2BAAsB,GAAtB,sBAAsB,CAAsC;QACvE,uBAAkB,GAAlB,kBAAkB,CAA2B;QAC3C,yBAAoB,GAApB,oBAAoB,CAA6B;QAC7C,6BAAwB,GAAxB,wBAAwB,CAAwC;QACnE,iCAA4B,GAA5B,4BAA4B,CAAqC;QACpE,8BAAyB,GAAzB,yBAAyB,CAAkC;QAC5D,sBAAiB,GAAjB,iBAAiB,CAAiC;QAKnD,4BAAuB,GAAvB,uBAAuB,CAAgC;QACrD,8BAAyB,GAAzB,yBAAyB,CAAkC;QACnD,+BAA0B,GAA1B,0BAA0B,CAAmC;QAI1D,yCAAoC,GAApC,oCAAoC,CAA6C;QAWnF,gCAA2B,GAA3B,2BAA2B,CAA8B;QAKxD,qBAAgB,GAAhB,gBAAgB,CAA0B;QAMnG,gCAA2B,GAA3B,2BAA2B,CAA4C;QAMvE,yCAAoC,GAApC,oCAAoC,CAAqD;QAK3F,4BAAuB,GAAvB,uBAAuB,CAAwC;QAIQ,uCAAkC,GAAlC,kCAAkC,CAA4C;QAEtK,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,wBAAwB,GAAG,wBAAwB,CAAC;QACzD,IAAI,CAAC,2BAA2B,GAAG,2BAA2B,CAAC;QAC/D,IAAI,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;QACvD,IAAI,CAAC,0BAA0B,GAAG,0BAA0B,CAAC;QAC7D,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QAEnD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAEzE,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU,CAAC,MAAuC;QAE3D,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,OAAO;QACX,CAAC;QAED,MAAM,EACF,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,6BAA6B,EAC7B,+BAA+B,EAC/B,4BAA4B,GAAG,EAAE,EACjC,4BAA4B,EAC5B,yBAAyB,EACzB,qCAAqC,EACrC,uBAAuB,EACvB,4BAA4B,EAC5B,WAAW,EACX,iBAAiB,EACjB,SAAS,EACT,mBAAmB,EACnB,qBAAqB,GAAG,KAAK,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,gBAAgB,EAChB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,4BAA4B,EAC5B,aAAa,EACb,uBAAuB,EACvB,SAAS,EAAE,iBAAiB,EAC5B,sBAAsB,EACtB,eAAe,GAAG,EAAE,EACpB,cAAc,GAAG,yBAAyB,CAAC,mBAAmB,EAC9D,YAAY,GAAG,KAAK,EACpB,YAAY,GAAG,KAAK,EACpB,gBAAgB,GAAG,KAAK,EACxB,gCAAgC,EAChC,iCAAiC,GACpC,GAAG,MAAM,CAAC;QAEX;;;;WAIG;QACH,MAAM,iBAAiB,GAAG,uCAAuC,CAAC,iBAAiB,IAAI,EAAE,EAAE,kCAAkC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5I,MAAM,SAAS,GAAqC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClI,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;gBAChE,sBAAsB,EAAE,kCAAkC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,YAAY;gBACvF,gBAAgB,EAAE,iBAAiB,CAAC,gBAAgB;aACvD,CAAC,CAAC;QACP,CAAC;QAED,qEAAqE;QACrE,sEAAsE;QACtE,yCAAyC;QACzC,MAAM,cAAc,GAAG,8CAA8C,CAAC,cAAc,CAAC,CAAC;QACtF;;;;WAIG;QACH,IAAI,CAAC,sBAAsB,GAAG,cAAc,CAAC;QAE7C,IAAI,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;YACnE,+CAA+C;YAC/C,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAE9D,mDAAmD;YACnD,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,qBAAqB,CAAC;YAE9C,IAAG,CAAC,qBAAqB,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;gBACzC,IAAI,eAAe,EAAE,CAAC;oBAClB,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;gBAChE,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;gBAC9D,IAAI,aAAa,EAAE,CAAC;oBAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;wBACvC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;qBACvC,CAAC,CAAC;gBACP,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,+BAA+B,EAAE,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;gBAEtE;;;;;;;;;;;;;mBAaG;gBACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;gBACjG,IAAI,kBAAkB,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,+BAA+B,kBAAkB,CAAC,UAAU,uBAAuB;0BACjF,gBAAgB,kBAAkB,CAAC,cAAc,mDAAmD;0BACpG,YAAY,kBAAkB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;0BAC1D,2EAA2E,EAC7E,EAAE,cAAc,EAAE,kBAAkB,CAAC,cAAc,EAAE,UAAU,EAAE,kBAAkB,CAAC,UAAU,EAAE,YAAY,EAAE,kBAAkB,CAAC,YAAY,EAAE,CAClJ,CAAC;gBACN,CAAC;gBACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA+BG;gBACH,IAAI,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChE,IAAI,CAAC;wBACD,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;wBACpC,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;oBAC9D,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAQ,CAAC,CAAC;wBACnE,MAAM,CAAC,CAAC;oBACZ,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,QAAQ,CAAC,iFAAiF,CAAC,CAAC;gBACrG,CAAC;gBACD,uEAAuE;gBACvE,oEAAoE;gBACpE,IAAI,CAAC;oBACD,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;oBAClC,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACT,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,GAAG,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrH,CAAC;gBAED,6EAA6E;gBAC7E,IAAI,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,EAAE,CAAC;oBACxC,IAAI,CAAC;wBACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;wBAC1C,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;oBAChD,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACT,8EAA8E;wBAC9E,8EAA8E;wBAC9E,0EAA0E;wBAC1E,0CAA0C;wBAC1C,EAAE;wBACF,2EAA2E;wBAC3E,0EAA0E;wBAC1E,6EAA6E;wBAC7E,6EAA6E;wBAC7E,2EAA2E;wBAC3E,6EAA6E;wBAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uFAAuF,EAAE,EAAE,GAAG,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACrJ,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,QAAQ,CAAC,yDAAyD,CAAC,CAAC;gBAC7E,CAAC;YACL,CAAC;YAED,8DAA8D;YAC9D,iEAAiE;YACjE,6DAA6D;YAC7D,gEAAgE;YAChE,MAAM,iBAAiB,GAAG,kCAAkC,CAAC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;YAE3G,IAAI,iBAAiB,EAAE,CAAC;gBACpB,mFAAmF;gBACnF,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,oBAAoB,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YAChH,CAAC;YAED;;;;;;;;;;;;eAYG;YACH;;;;;;;;;;;;;;eAcG;YACH,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,sBAAsB,KAAK,yBAAyB,CAAC,mBAAmB,EAAE,CAAC;gBAChH;;;;;;;;;;;;;;mBAcG;gBACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;gBAC9E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,EAAE,0BAA0B,KAAK,SAAS,EAAE,CAAC;oBAC1F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACL,IAAI,EAAE,uBAAuB,CAAC,2BAA2B;4BACzD,OAAO,EAAE,eAAe;4BACxB,OAAO,EAAE,gDAAgD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;kCACnG,kGAAkG;kCAClG,qGAAqG;kCACrG,sEAAsE;yBAC/E;qBACJ,CAAC,CAAC;gBACP,CAAC;gBACD,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CACzC,iBAAiB,EAAE,eAAe,EAClC,iCAAiC,CAAC;oBAC9B,YAAY,EAAE,eAAe,EAAE,0BAA0B;iBAC5D,CAAC,EACF,SAAS,EACT,SAAS;gBACT;;;;mBAIG;gBACH,uCAAuC,CAAC;oBACpC,YAAY,EAAE,eAAe,EAAE,0BAA0B;iBAC5D,CAAC,CACL,CAAC;YACN,CAAC;YAED,2CAA2C;YAC3C,IAAI,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;YACxD,IAAI,WAAW,EAAE,CAAC;gBACd,IAAI,CAAC,qBAAqB,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;gBAClE,IAAI,CAAC,QAAQ,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACJ,iEAAiE;gBACjE,IAAI,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YAED,4FAA4F;YAC5F,gGAAgG;YAChG,0FAA0F;YAC1F,+EAA+E;YAC/E,MAAM,yBAAyB,GAAG,2CAA2C,CAAC;gBAC1E,iBAAiB,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAU;gBAChI,wBAAwB,EAAE,cAAc,CAAC,SAAS;gBAClD,yBAAyB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,oBAAoB,CAAC,aAAa,CAAC;aACtI,CAAC,CAAC;YACH,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACL,MAAM,EAAE,wCAAwC;wBAChD,UAAU,EAAE,yBAAyB;wBACrC,OAAO,EAAE,oGAAoG;8BACvG,sGAAsG;8BACtG,wEAAwE;8BACxE,qCAAqC;qBAC9C;iBACJ,CAAC,CAAC;YACP,CAAC;YAED,0GAA0G;YAC1G,+GAA+G;YAC/G,oGAAoG;YACpG,CAAC;gBACG,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBACnI,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC;gBAChH,MAAM,4BAA4B,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAC5G,4CAA4C,CACvC,UAAiH,EAAE,uBAAuB,EAAE,uBAAuB,EACpK,EAAE,gBAAgB,EAAE,CACvB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,gBAAgB,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;gBACvD,IAAI,4BAA4B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;wBACjE,OAAO,EAAE;4BACL,MAAM,EAAE,oDAAoD;4BAC5D,MAAM,EAAE,4BAA4B;4BACpC,OAAO,EAAE,kHAAkH;kCACrH,6DAA6D;yBACtE;qBACJ,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAED,6GAA6G;YAC7G,6GAA6G;YAC7G,uGAAuG;YACvG,MAAM,wBAAwB,GAAG,wCAAwC,CAAC;gBACtE,yBAAyB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,oBAAoB,CAAC,aAAa,CAAC;gBACnI,yBAAyB,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;gBAC/E,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;aACjF,CAAC,CAAC;YACH,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACL,MAAM,EAAE,qCAAqC;wBAC7C,UAAU,EAAE,wBAAwB;wBACpC,OAAO,EAAE,4GAA4G;8BAC/G,+GAA+G;8BAC/G,yDAAyD;qBAClE;iBACJ,CAAC,CAAC;YACP,CAAC;YAED;;;;;;;;;eASG;YACH,IAAI,CAAC,wBAAwB,CAAC,wBAAwB,CAClD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,KAAK,CAAC,CACrF,CAAC;YAEF,2DAA2D;YAC3D,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YAEvD,sFAAsF;YACtF,gEAAgE;YAChE,MAAM,eAAe,GAAgC,iBAAiB,EAAE,SAAS,CAAC;YAElF,8DAA8D;YAC9D,wEAAwE;YACxE,yEAAyE;YACzE,0EAA0E;YAC1E,4EAA4E;YAC5E,MAAM,qBAAqB,GAAG,yCAAyC,CACnE,iBAAiB,EACjB,EAAE,qBAAqB,EAAE,CAC5B,CAAC;YAEF,IAAI,qBAAqB,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,qCAAqC,qBAAqB,CAAC,IAAI,QAAQ,EAAE;oBACnF,eAAe,EAAE,CAAC,iBAAiB,EAAE,OAAO,EAAE,OAAO;oBACrD,qBAAqB,EAAE,CAAC,GAAG,EAAE;wBACzB,MAAM,aAAa,GAAG,iBAAiB,EAAE,OAAO,CAAC;wBACjD,IAAI,CAAC,aAAa,EAAE,OAAO;4BAAE,OAAO,KAAK,CAAC;wBAC1C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,aAAa,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;wBACtE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1D,CAAC,CAAC,EAAE;oBACJ,iBAAiB,EAAE,CAAC,eAAe,EAAE,OAAO;iBAC/C,CAAC,CAAC;YACP,CAAC;YAED,MAAM,IAAI,CAAC,wBAAwB,CAAC,UAAU,CACtC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,CAAC,6BAA6B,IAAI,EAAE,CAAmD,EACvF,+BAA+B,EAC/B,4BAA4B,EAC5B,4BAA4B,EAC5B,SAAS,EAAE,8CAA8C;YACzD,qBAAqB,EACrB,yBAAyB,EACzB,qCAAqC,CAC5C,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YAC/D,IAAI,iBAAiB,IAAI,iCAAiC,EAAE,CAAC;gBACzD,MAAM,iCAAiC,CAAC;oBACpC,SAAS,EAAE,iBAAiB;oBAC5B,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;oBACvD,YAAY,EAAE,IAAI,CAAC,YAAY;iBAClC,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,mBAAmB,IAAI,EAAE,EAAE;gBACjE,kBAAkB,EAAE,cAAc,CAAC,sCAAsC;aAC5E,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;YAClE,IAAI,CAAC,kCAAkC,EAAE,UAAU,CAAC,4BAA4B,IAAI,EAAE,EAAE;gBACpF,kBAAkB,EAAE,cAAc,CAAC,sCAAsC;aAC5E,CAAC,CAAC;YAEH,qDAAqD;YACrD,IAAI,CAAC,QAAQ,CAAC,iDAAiD,CAAC,CAAC;YACjE,IAAI,CAAC,gCAAgC,CAAC,oBAAoB,EAAE,CAAC;YAC7D,IAAI,wBAAwB,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,gCAAgC,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,CAAC,gCAAgC,CAAC,mBAAmB,EAAE,CAAC;YAC5D,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,EAAE,CAAC;YAE1D,oEAAoE;YACpE,IAAI,0BAA0B,EAAE,CAAC;gBAC7B,MAAM,cAAc,GAAG,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,EAAE,CAAC;gBACjF,IAAI,CAAC,gCAAgC,CAAC,gBAAgB,CAAC;oBACnD,WAAW,EAAE,cAAc;oBAC3B,QAAQ,EAAE,0BAA0B,CAAC,QAAQ,IAAI,EAAE;oBACnD,cAAc,EAAE,0BAA0B,CAAC,cAAc;oBACzD,oBAAoB,EAAE;wBAClB,eAAe,EAAE,0BAA0B,CAAC,oBAAoB,EAAE,eAAe,IAAI,6BAA6B,CAAC,cAAc;wBACjI,mBAAmB,EAAE,0BAA0B,CAAC,oBAAoB,EAAE,mBAAmB,IAAI,6BAA6B,CAAC,IAAI;wBAC/H,YAAY,EAAE,0BAA0B,CAAC,oBAAoB,EAAE,YAAY,IAAI,EAAE;wBACjF,cAAc,EAAE,0BAA0B,CAAC,oBAAoB,EAAE,cAAc,IAAI;4BAC/E,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE,6BAA6B,CAAC,cAAc;4BAC/F,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,6BAA6B,CAAC,oBAAoB;4BAChG,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,6BAA6B,CAAC,IAAI;yBACnF;qBACJ;iBACJ,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,gEAAgE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,SAAS,EAAE,YAAY,CAAC;YAEzE,IAAI,CAAC,gCAAgC,CAAC,0BAA0B,EAAE,CAAC;YACnE,IAAI,CAAC,gCAAgC,CAAC,4BAA4B,CAAC;gBAC/D,eAAe,EAAE,0BAA0B,EAAE,QAAQ;gBACrD,gBAAgB;gBAChB,uBAAuB;gBACvB,kBAAkB;gBAClB,qBAAqB;gBACrB,eAAe,EAAE,CAAC,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC;aAClI,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YAExE,uDAAuD;YACvD,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;YAClE,IAAI,yBAAyB,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpE,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,yBAAyB,EAAE,CAAC;oBAClD,IAAI,CAAC,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,cAAc,yBAAyB,CAAC,MAAM,gCAAgC,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,0BAA0B,IAAI,0BAA0B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtE,IAAI,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;gBACtF,IAAI,CAAC,2BAA2B,CAAC,mBAAmB,EAAE,CAAC;gBACvD,IAAI,CAAC,2BAA2B,CAAC,iBAAiB,EAAE,CAAC;YACzD,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,0DAA0D,CAAC,CAAC;YAE1E;;;;;;;;;;eAUG;YACH,IAAI,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxD,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,mBAAmB,EAAE,CAAC;oBAC5C,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,cAAc,mBAAmB,CAAC,MAAM,0BAA0B,CAAC,CAAC;YACtF,CAAC;YACD,IAAI,qBAAqB,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;gBAC9E,IAAI,CAAC,6BAA6B,CAAC,mBAAmB,EAAE,CAAC;gBACzD,IAAI,CAAC,6BAA6B,CAAC,iBAAiB,EAAE,CAAC;YAC3D,CAAC;YAED,2DAA2D;YAC3D;;;;;eAKG;YACH,IAAI,CAAC,qBAAqB,IAAI,eAAe,EAAE,OAAO,IAAI,cAAc,CAAC,yBAAyB,EAAE,CAAC;gBACjG,IAAI,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;gBACxD,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;gBAE5D,mEAAmE;gBACnE,wCAAwC,CAAC,IAAI,CAAC,kBAAkB,EAAE,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBAEtG,uDAAuD;gBACvD,IAAI,eAAe,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC;oBAC/C,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC;wBAClE;;;;;;;2BAOG;wBACH,MAAM,YAAY,GAAG,SAAS,CAAC,aAAa,KAAK,uBAAuB,CAAC,SAAS;4BAC9E,CAAC,CAAC,SAAS,CAAC,YAAY;4BACxB,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC;wBAChC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;4BACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,uCAAuC,YAAY,gDAAgD;kCAC7F,oDAAoD,CAC7D,CAAC;wBACN,CAAC;wBACD,IAAI,SAAS,CAAC,aAAa,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;4BAChE;;;;;;+BAMG;4BACH,IAAI,CAAC,cAAc,CAAC,+CAA+C,EAAE,CAAC;gCAClE,IAAI,CAAC,QAAQ,CACT,mCAAmC,SAAS,CAAC,YAAY,kBAAkB;sCACrE,oBAAoB,cAAc,oCAAoC,CAC/E,CAAC;4BACN,CAAC;iCAAM,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;gCACjF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,SAAS,CAAC,YAAY,GAAG,CAAC,CAAC;4BACjH,CAAC;wBACL,CAAC;6BAAM,IAAI,SAAS,CAAC,aAAa,KAAK,uBAAuB,CAAC,kBAAkB,EAAE,CAAC;4BAChF,IAAI,CAAC,QAAQ,CAAC,6DAA6D,SAAS,CAAC,eAAe,0BAA0B,CAAC,CAAC;wBACpI,CAAC;oBACL,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE;oBAC9C,qBAAqB,EAAE,eAAe,CAAC,qBAAqB;oBAC5D,uBAAuB,EAAE,eAAe,CAAC,uBAAuB;oBAChE,oBAAoB,EAAE,eAAe,CAAC,oBAAoB;oBAC1D,uBAAuB,EAAE,eAAe,CAAC,kBAAkB,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;iBACrF,CAAC,CAAC;YACP,CAAC;iBAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,4EAA4E,CAAC,CAAC;YAChG,CAAC;YAED,8EAA8E;YAC9E,EAAE;YACF,sEAAsE;YACtE,6EAA6E;YAC7E,gFAAgF;YAChF,+EAA+E;YAC/E,+EAA+E;YAC/E,EAAE;YACF,kFAAkF;YAClF,mFAAmF;YACnF,gFAAgF;YAChF,iDAAiD;YACjD,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;YACjD,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC;gBAC3D,eAAe;gBACf,mBAAmB,EAAE,uBAAuB;aAC/C,CAAC,CAAC;YACH,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAC1C,iBAAiB,CAAC,QAAQ,EAC1B,eAAe,EACf,iBAAiB,CAAC,UAAU,CAC/B,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE;gBACrD,sBAAsB,EAAE,OAAO,CAAC,eAAe,CAAC;gBAChD,aAAa,EAAE,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI;aAChF,CAAC,CAAC;YAEH,oDAAoD;YACpD,8FAA8F;YAC9F,IAAI,iBAAiB,EAAE,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAAC;gBAChE,MAAM,IAAI,CAAC,gCAAgC,CAAC,UAAU,EAAE,CAAC;gBACzD,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;gBAExE,qFAAqF;gBACrF,oFAAoF;gBACpF,8EAA8E;gBAC9E,gFAAgF;gBAChF,kFAAkF;gBAClF,yBAAyB;gBACzB,IAAI,CAAC,gCAAgC,CAAC,6BAA6B,CAAC;oBAChE,kBAAkB,EAAE,cAAc,CAAC,oCAAoC;iBAC1E,CAAC,CAAC;gBAEH,yEAAyE;gBACzE,6EAA6E;gBAC7E,6EAA6E;gBAC7E,yEAAyE;gBACzE,2EAA2E;gBAC3E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,yDAAyD;gBACzD,EAAE;gBACF,4EAA4E;gBAC5E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,4EAA4E;gBAC5E,8EAA8E;gBAC9E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,8EAA8E;gBAC9E,4EAA4E;gBAC5E,MAAM,yBAAyB,GAAG,IAAI,CAAC,gCAAgC,CAAC,oCAAoC,CACxG,gBAAgB,CAAC,sBAAsB,CAC1C,CAAC;gBACF,MAAM,oBAAoB,GAAG;oBACzB,yCAAyC,EAAE,cAAc,CAAC,kCAAkC;oBAC5F,2BAA2B,EAAE,IAAI,CAAC,gCAAgC,CAAC,yBAAyB,CACxF,gBAAgB,CAAC,sBAAsB,CAC1C;oBACD,6BAA6B,EAAE,yBAAyB,CAAC,MAAM;iBAClE,CAAC;gBACF,yFAAyF;gBACzF,0FAA0F;gBAC1F,kDAAkD;gBAClD,IAAI,mCAAmC,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,yBAAyB,EAAE,CAAC,GAAG,yBAAyB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChI,CAAC;gBACD,IAAI,qCAAqC,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,0FAA0F;0BACxF,8FAA8F;0BAC9F,+FAA+F,CACpG,CAAC;gBACN,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,+GAA+G,CAAC,CAAC;YACnI,CAAC;YAED,6CAA6C;YAC7C,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;YAC1D,MAAM,gCAAgC,GAAG;gBACrC,GAAG,CAAC,mBAAmB,EAAE,0BAA0B,IAAI,EAAE,CAAC;aAC7D,CAAC;YACF,MAAM,YAAY,GAAG;gBACjB,GAAG,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE,CAAC;aACzC,CAAC;YACF,MAAM,mBAAmB,GAAG;gBACxB,GAAG,CAAC,mBAAmB,EAAE,aAAa,IAAI,EAAE,CAAC;aAChD,CAAC;YACF,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAC5C,gCAAgC,EAChC,YAAY,EACZ,mBAAmB,EACnB,SAAS,EACT,mBAAmB,EAAE,gBAAgB,IAAI,EAAE,CAC9C,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;YAElE,uFAAuF;YACvF,2FAA2F;YAC3F,2FAA2F;YAC3F,2FAA2F;YAC3F,wFAAwF;YACxF,yFAAyF;YACzF,mCAAmC;YACnC,+EAA+E;YAC/E,mFAAmF;YACnF,gFAAgF;YAChF,mFAAmF;YACnF,mFAAmF;YACnF,6EAA6E;YAC7E,gFAAgF;YAChF,uCAAuC;YACvC,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;YACtE,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;YACzE,IAAI,cAAc,CAAC,2CAA2C,EAAE,CAAC;gBAC7D,IAAI,CAAC,+BAA+B,CAAC,0BAA0B,CAC3D,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EACvE,IAAI,CAAC,0BAA0B;qBAC1B,SAAS,EAAE;qBACX,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,0BAA0B,CAAC,QAAQ,CAAC;qBAC7E,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CACnC,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,6DAA6D,CAAC,CAAC;YACjF,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,sGAAsG,EAAE;oBAClH,cAAc;iBACjB,CAAC,CAAC;YACP,CAAC;YAED,uDAAuD;YACvD,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;YACjD,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,EAAE;gBAC5C,oBAAoB,EAAE,qBAAqB;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;YAEzD,gDAAgD;YAChD,IAAI,wBAAwB,IAAI,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/E,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;YAC3E,CAAC;YAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACzB,+EAA+E;gBAC/E,gFAAgF;gBAChF,mFAAmF;gBACnF,qFAAqF;gBACrF,kFAAkF;gBAClF,IAAI,CAAC,2BAA2B,EAAE,UAAU,EAAE,CAAC;YACnD,CAAC;YAED,uCAAuC;YACvC,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzF,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;oBACtC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBACtD,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;YACrG,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YAED,gDAAgD;YAChD,IAAI,uBAAuB,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,uBAAuB,CAAC,MAAM,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC;gBACvE,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,uBAAuB,CAAC,MAAM,EAAE,CAAC,CAAC;YACpH,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,0EAA0E,CAAC,CAAC;YAC9F,CAAC;YAED,iCAAiC;YACjC,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YAC/D,IAAI,CAAC,wBAAwB,CAAC,yBAAyB,EAAE,CAAC;YAE1D,2CAA2C;YAC3C,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,MAAM,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,EAAE,CAAC;YAE/E,2EAA2E;YAC3E,sEAAsE;YACtE,kEAAkE;YAClE,6EAA6E;YAC7E,iDAAiD;YACjD,EAAE;YACF,6EAA6E;YAC7E,+EAA+E;YAC/E,6EAA6E;YAC7E,6EAA6E;YAC7E,2EAA2E;YAC3E,+BAA+B;YAC/B,IAAI,uBAAuB,GAAqC,EAAE,CAAC;YACnE,IAAI,CAAC;gBACD,uBAAuB,GAAG,qCAAqC,CAC3D,iBAAiB,CAAC,sBAA6B,CAClD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0EAA0E,EAAE;oBACzF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACxC,CAAC,CAAC;YACP,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,uBAAuB,EAAE,CAAC;gBAC9C,IAAI,SAAS,CAAC,QAAQ,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;oBACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,SAAS,CAAC,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE;wBAC9G,YAAY,EAAE,SAAS,CAAC,YAAY;wBACpC,eAAe,EAAE,SAAS,CAAC,eAAe;wBAC1C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;wBAChD,IAAI,EAAE,SAAS,CAAC,IAAI;qBACvB,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YACD,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,MAAM,CACxD,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,sCAAsC,CAAC,IAAI,CACpF,CAAC;YACF,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACX,kCAAkC,qBAAqB,CAAC,MAAM,8DAA8D;oBAC5H,qBAAqB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9E,CAAC;YACN,CAAC;YAED,+CAA+C;YAC/C,kGAAkG;YAClG,kGAAkG;YAClG,mGAAmG;YACnG,4FAA4F;YAC5F,2FAA2F;YAC3F,2FAA2F;YAC3F,4FAA4F;YAC5F,8FAA8F;YAC9F,IAAI,0BAA0B,GAAqC,EAAE,CAAC;YACtE,IAAI,CAAC;gBACD,0BAA0B,GAAG,2CAA2C,CAAC,iBAAiB,CAAC,sBAA6B,CAAC,CAAC;YAC9H,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,EAAE;oBAC5E,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACxC,CAAC,CAAC;YACP,CAAC;YACD,IAAI,0BAA0B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACX,kCAAkC,0BAA0B,CAAC,MAAM,mFAAmF;oBACtJ,0BAA0B,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACvF,CAAC;YACN,CAAC;YAED,mEAAmE;YACnE,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,sEAAsE;YACtE,0EAA0E;YAC1E,0EAA0E;YAC1E,+CAA+C;YAC/C,mDAAmD;YACnD,IAAI,gCAAgC,GAAsC,EAAE,CAAC;YAC7E,IAAI,CAAC;gBACD,gCAAgC,GAAG,8BAA8B,CAC7D,iBAAiB,CAAC,sBAA6B,CAClD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;oBAChF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACxC,CAAC,CAAC;YACP,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,gCAAgC,EAAE,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,SAAS,CAAC,OAAO,EAAE,EAAE;oBAClE,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;oBAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;oBAChD,aAAa,EAAE,SAAS,CAAC,aAAa;iBACzC,CAAC,CAAC;YACP,CAAC;YACD,IAAI,gCAAgC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CACX,kCAAkC,gCAAgC,CAAC,MAAM,uCAAuC;oBAChH,gDAAgD;oBAChD,gCAAgC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7F,CAAC;YACN,CAAC;YAED,4EAA4E;YAC5E,0FAA0F;YAC1F,kGAAkG;YAClG,6FAA6F;YAC7F,+FAA+F;YAC/F,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,yFAAyF;YACzF,sFAAsF;YACtF,yFAAyF;YACzF,0FAA0F;YAC1F,yBAAyB;YACzB,0FAA0F;YAC1F,wFAAwF;YACxF,oEAAoE;YACpE,IAAI,6BAA6B,GAA8C,EAAE,CAAC;YAClF,IAAI,CAAC;gBACD,6BAA6B,GAAG,sCAAsC,CAClE,iBAAiB,CAAC,sBAA6B,CAClD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0EAA0E,EAAE;oBACzF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACxC,CAAC,CAAC;YACP,CAAC;YACD,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,MAAM,CAC/D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,sBAAsB,CAAC,MAAM,CACtE,CAAC;YACF,MAAM,uBAAuB,GAAG,6BAA6B,CAAC,MAAM,CAChE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,sBAAsB,CAAC,MAAM,CACtE,CAAC;YACF,0FAA0F;YAC1F,qEAAqE;YACrE,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,uFAAuF;gBACvF,sFAAsF;gBACtF,sFAAsF;gBACtF,gFAAgF;gBAChF,8DAA8D;gBAC9D,MAAM,aAAa,GAAG;oBAClB,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;iBACtG,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,yCAAyC,aAAa,CAAC,MAAM,2CAA2C;oBACxG,uGAAuG;oBACvG,qGAAqG;oBACrG,kGAAkG;oBAClG,sGAAsG;oBACtG,sBAAsB,EACtB;oBACI,KAAK,EAAE,aAAa;oBACpB,qFAAqF;oBACrF,uEAAuE;oBACvE,qBAAqB,EAAE,uBAAuB,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM;iBAC/E,CACJ,CAAC;YACN,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,sBAAsB,EAAE,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,SAAS,CAAC,OAAO,EAAE,EAAE;oBAC3E,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;oBAC9C,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;oBAChD,QAAQ,EAAE,SAAS,CAAC,QAAQ;iBAC/B,CAAC,CAAC;YACP,CAAC;YACD,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACX,kCAAkC,sBAAsB,CAAC,MAAM,wCAAwC;oBACvG,mHAAmH;oBACnH,sBAAsB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnF,CAAC;YACN,CAAC;YAED,sFAAsF;YACtF,yFAAyF;YACzF,yFAAyF;YACzF,4FAA4F;YAC5F,4FAA4F;YAC5F,yFAAyF;YACzF,iEAAiE;YACjE,EAAE;YACF,6FAA6F;YAC7F,uFAAuF;YACvF,2FAA2F;YAC3F,6FAA6F;YAC7F,2DAA2D;YAC3D,IAAI,0BAA0B,GAAkE,EAAE,CAAC;YACnG,IAAI,CAAC;gBACD,0BAA0B,GAAG,0CAA0C,CACnE,iBAAiB,CAAC,sBAA6B,CAClD,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;oBACxF,GAAG,2BAA2B,CAAC,KAAK,CAAC;iBACxC,CAAC,CAAC;YACP,CAAC;YACD,IAAI,0BAA0B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,yCAAyC,0BAA0B,CAAC,MAAM,mCAAmC;oBAC7G,0GAA0G;oBAC1G,2GAA2G;oBAC3G,0EAA0E;oBAC1E,0GAA0G;oBAC1G,mFAAmF,EACnF;oBACI,KAAK,EAAE,0BAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,GAAG,IAAI,CAAC,iBAAiB,OAAO,IAAI,CAAC,kBAAkB,EAAE;wBACzD,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,WAAW,GAAG,CAAC;iBAC3F,CACJ,CAAC;YACN,CAAC;YAED,kFAAkF;YAClF,6EAA6E;YAC7E,6EAA6E;YAC7E,2EAA2E;YAC3E,+EAA+E;YAC/E,2EAA2E;YAC3E,iFAAiF;YACjF,+EAA+E;YAC/E,+EAA+E;YAC/E,iFAAiF;YACjF,6EAA6E;YAC7E,kFAAkF;YAClF,MAAM,+BAA+B,GAAa,EAAE,CAAC;YACrD,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,CACnC,iBAAiB,CAAC,sBAAsB,CACS,EAAE,CAAC;gBACpD,MAAM,iBAAiB,GAAG,WAAW,CAAC,kBAAkB,CAAC;gBACzD,MAAM,mBAAmB,GAA6B,WAAW,CAAC,qBAAqB,EAAE,mBAAmB,IAAI,EAAE,CAAC;gBACnH,KAAK,MAAM,YAAY,IAAI,mBAAmB,EAAE,CAAC;oBAC7C,IAAI,YAAY,CAAC,MAAM,KAAK,kBAAkB,CAAC,WAAW;wBAAE,SAAS;oBACrE,IAAI,YAAY,CAAC,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,KAAK,IAAI;wBAAE,SAAS;oBACxF,uEAAuE;oBACvE,2EAA2E;oBAC3E,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,iBAAiB,CAAC;wBAAE,SAAS;oBAC5F,IAAI,CAAC;wBACD,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,CACxD,iBAAiB,EACjB,qBAAqB,CAAC,MAAM,CAC/B,CAAC;oBACN,CAAC;oBAAC,MAAM,CAAC;wBACL,+BAA+B,CAAC,IAAI,CAChC,sBAAsB,iBAAiB,cAAc,YAAY,CAAC,aAAa,aAAa;4BAC5F,kGAAkG;4BAClG,kGAAkG;4BAClG,kGAAkG,CACrG,CAAC;oBACN,CAAC;gBACL,CAAC;YACL,CAAC;YACD,IAAI,+BAA+B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CACX,kCAAkC,+BAA+B,CAAC,MAAM,uCAAuC;oBAC/G,uFAAuF;oBACvF,+BAA+B,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAChF,CAAC;YACN,CAAC;YAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAClC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,sBAAsB,CAA2D,CACrH,CAAC;YAEF,IAAI,0BAA0B,KAAK,SAAS,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACrE,MAAM,IAAI,KAAK,CACX,uFAAuF;sBACrF,0FAA0F;sBAC1F,gDAAgD,CACrD,CAAC;YACN,CAAC;YACD,IAAI,0BAA0B,KAAK,SAAS,EAAE,CAAC;gBAC3C,oFAAoF;gBACpF,IAAI,CAAC,2BAA2B,CAAC,wCAAwC,CAAC,0BAA0B,CAAC,CAAC;YAC1G,CAAC;YAED,oEAAoE;YACpE,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,sBAAsB,EAAE,gBAAgB,IAAI,SAAS,CAAC,CAAC;YACrH,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;YAElE,2FAA2F;YAC3F,4FAA4F;YAC5F,wFAAwF;YACxF,kFAAkF;YAClF,6FAA6F;YAC7F,2FAA2F;YAC3F,2FAA2F;YAC3F,yDAAyD;YACzD,uFAAuF;YACvF,0FAA0F;YAC1F,oFAAoF;YACpF,wFAAwF;YACxF,oFAAoF;YACpF,wEAAwE;YACxE,EAAE;YACF,wFAAwF;YACxF,sFAAsF;YACtF,sFAAsF;YACtF,wFAAwF;YACxF,kFAAkF;YAClF,gFAAgF;YAChF,2EAA2E;YAC3E,+DAA+D;YAC/D,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACzB,IAAI,CAAC,QAAQ,CAAC,uDAAuD,CAAC,CAAC;gBACvE,MAAM,IAAI,CAAC,2BAA2B,CAAC,8BAA8B,EAAE,CAAC;gBAExE,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,2BAA2B,CAAC,4BAA4B,EAAE,CAAC;gBACtE,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YAED,6DAA6D;YAC7D,gEAAgE;YAChE,qCAAqC;YACrC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC;gBAC/B,GAAG,2CAA2C;gBAC9C,GAAG,4BAA4B;aAClC,CAAC,CAAC;YAEH,IAAI,iBAAiB,EAAE,CAAC;gBACpB,6DAA6D;gBAC7D,0DAA0D;gBAC1D,yDAAyD;gBACzD,4DAA4D;gBAC5D,IAAI,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAAC;gBAChE,IAAI,CAAC,iCAAiC,CAAC,mCAAmC,CAAC,iBAAiB,CAAC,CAAC;gBAC9F,kFAAkF;gBAClF,mFAAmF;gBACnF,gFAAgF;gBAChF,MAAM,IAAI,CAAC,iCAAiC,CAAC,qCAAqC,EAAE,CAAC;gBACrF,2FAA2F;gBAC3F,6FAA6F;gBAC7F,2FAA2F;gBAC3F,IAAI,cAAc,CAAC,wBAAwB,EAAE,CAAC;oBAC1C,MAAM,uBAAuB,GAAG,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,EAAE;yBAC3E,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC;oBACjG,MAAM,sCAAsC,CAAC;wBACzC,cAAc,EAAE,uBAAgC;wBAChD,iBAAiB,EAAE,uBAAgC;wBACnD,QAAQ,EAAE,iBAAiB,CAAC,UAAU,EAAE,aAAa;wBACrD,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;wBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;qBACtB,CAAC,CAAC;gBACP,CAAC;gBACD,IAAI,cAAc,CAAC,sCAAsC,EAAE,CAAC;oBACxD,MAAM,IAAI,CAAC,iCAAiC;yBACvC,8CAA8C,CAC3C,iBAAiB,CACpB,CAAC;gBACV,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,QAAQ,CACT,oFAAoF;0BAClF,oFAAoF;0BACpF,oFAAoF;0BACpF,kEAAkE,CACvE,CAAC;gBACN,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;YAC5E,CAAC;YAED,8DAA8D;YAC9D,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,EAAE,CAAC;YAExD,wGAAwG;YACxG,wEAAwE;YACxE,EAAE;YACF,uGAAuG;YACvG,uGAAuG;YACvG,gGAAgG;YAChG,sFAAsF;YACtF,EAAE;YACF,oGAAoG;YACpG,yGAAyG;YACzG,qGAAqG;YACrG,6CAA6C;YAC7C,IAAI,CAAC,qBAAqB,IAAI,cAAc,CAAC,6BAA6B,EAAE,CAAC;gBACzE,MAAM,sCAAsC,CAAC;oBACzC,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;oBACtD,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB;oBACvD,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;wBACnC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;4BACzB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;wBAC3E,CAAC;wBACD,8EAA8E;wBAC9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,UAAU,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;oBAC3G,CAAC;iBACJ,CAAC,CAAC;YACP,CAAC;YAED,oDAAoD;YACpD,EAAE;YACF,wFAAwF;YACxF,qFAAqF;YACrF,sFAAsF;YACtF,yFAAyF;YACzF,oFAAoF;YACpF,+EAA+E;YAC/E,EAAE;YACF,wFAAwF;YACxF,uFAAuF;YACvF,yEAAyE;YACzE,IAAI,SAAS,EAAE,CAAC;gBACZ,qDAAqD,CAAC,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;gBAC/F,wFAAwF;gBACxF,wFAAwF;gBACxF,6CAA6C,CAAC,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;YAC3F,CAAC;YAED,IAAI,gCAAgC,EAAE,CAAC;gBACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CAAC,2HAA2H,CAAC,CAAC;gBACjJ,CAAC;gBACD,IAAI,CAAC,uBAAuB,GAAG,gCAAgC,CAAC,IAAI,CAAC,uBAAuB,EAAE;oBAC1F,SAAS,EAAE,iBAAiB;oBAC5B,YAAY,EAAE,IAAI,CAAC,YAAY;iBAClC,CAAC,CAAC;gBACH,IAAI,CAAC,gCAAgC,CAAC,SAAS,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBAC/E,IAAI,CAAC,QAAQ,CAAC,0DAA0D,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAE9D,0FAA0F;YAC1F,EAAE;YACF,qFAAqF;YACrF,+EAA+E;YAC/E,gFAAgF;YAChF,yFAAyF;YACzF,uFAAuF;YACvF,IAAI,SAAS,EAAE,CAAC;gBACX,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,+BAA+B,CAA4C;qBACxG,QAAQ,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;oBAC/B,MAAO,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,eAAe,CAAmC;yBACrF,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC;gBACP,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YAED,oGAAoG;YACpG,yGAAyG;YACzG,IAAI,qBAAqB,GAAuC,IAAI,CAAC;YACrE,IAAI,iBAAiB,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC;gBACnD,qBAAqB,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3H,CAAC;YAED,6FAA6F;YAC7F,kGAAkG;YAClG,mGAAmG;YACnG,oFAAoF;YACpF,IAAI,CAAC,qBAAqB,IAAI,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,uBAAuB,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACnI,CAAC;YAED,yFAAyF;YACzF,IAAI,CAAC,qBAAqB,IAAI,SAAS,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,+BAA+B,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;YAED,iEAAiE;YACjE,IAAI,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;YAGzD,iDAAiD;YACjD,IAAI,oBAAoB,GAAuC,EAAE,CAAC;YAElE,IAAI,SAAS,EAAE,CAAC;gBACZ,2EAA2E;gBAC3E,uFAAuF;gBACvF,0FAA0F;gBAC1F,6FAA6F;gBAC7F,0CAA0C;gBAC1C,MAAM,4BAA4B,GAAG,sCAAsC,CACvE,IAAI,CAAC,wBAAwB,CAAC,0BAA0B,EAAE,CAC7D,CAAC;gBACF,MAAM,gBAAgB,GAAG,CAAC,CAAC,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC;gBACjE,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAC,SAAS,EAAE,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClJ,oBAAoB,GAAG;oBACnB,GAAG,iBAAiB;oBACpB,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;iBAC/B,CAAC;gBAIF,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;oBACxC,iBAAiB,EAAE,iBAAiB,CAAC,MAAM;oBAC3C,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;oBACxD,sBAAsB,EAAE,oBAAoB,CAAC,MAAM;iBACtD,CAAC,CAAC;YACP,CAAC;iBAAM,CAAC;gBACJ,oBAAoB,GAAG,iBAAiB,IAAI,EAAE,CAAC;gBAE/C,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;oBACxC,iBAAiB,EAAE,CAAC;oBACpB,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;oBACxD,sBAAsB,EAAE,oBAAoB,CAAC,MAAM;iBACtD,CAAC,CAAC;YACP,CAAC;YACD,IAAG,CAAC,qBAAqB,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAC5C,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,EAClE,mBAAmB,CACtB,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,iGAAiG,CAAC,CAAC;YACrH,CAAC;YAED,gFAAgF;YAChF,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YACvD,MAAM,aAAa,GAAG,oBAAoB;gBACtC,CAAC,CAAC,oBAAoB,CAAC;oBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,8BAA8B,EAAE,IAAI,CAAC,qCAAqC;oBAC1E,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;oBACvD,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;oBAC7D,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;iBACtD,CAAC;gBACJ,CAAC,CAAC,IAAI,GAAG,EAA4D,CAAC;YAE1E,2EAA2E;YAC3E,aAAa,CAAC,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACtE,yFAAyF;YACzF,oFAAoF;YACpF,qFAAqF;YACrF,oFAAoF;YACpF,wFAAwF;YACxF,aAAa,CAAC,GAAG,CAAC,kCAAkC,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC3F,qFAAqF;YACrF,2EAA2E;YAC3E,gFAAgF;YAChF,iFAAiF;YACjF,sEAAsE;YACtE,aAAa,CAAC,GAAG,CAAC,6BAA6B,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACjF,aAAa,CAAC,GAAG,CAAC,mCAAmC,EAAE,kCAAkC,EAAE,CAAC,CAAC;YAC7F,yGAAyG;YACzG,2GAA2G;YAC3G,aAAa,CAAC,GAAG,CAAC,oDAAoD,EAAE,kDAAkD,EAAE,CAAC,CAAC;YAC9H,8GAA8G;YAC9G,yGAAyG;YACzG,aAAa,CAAC,GAAG,CAAC,mDAAmD,EAAE,+CAA+C,EAAE,CAAC,CAAC;YAC1H,aAAa,CAAC,GAAG,CAAC,kCAAkC,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAC1F,0HAA0H;YAC1H,0FAA0F;YAC1F,4FAA4F;YAC5F,8FAA8F;YAC9F,aAAa,CAAC,GAAG,CAAC,qCAAqC,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAChG,gGAAgG;YAChG,gGAAgG;YAChG,aAAa,CAAC,GAAG,CAAC,iCAAiC,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACzF,iGAAiG;YACjG,oGAAoG;YACpG,gGAAgG;YAChG,aAAa,CAAC,GAAG,CAAC,gCAAgC,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACvF,mGAAmG;YACnG,oGAAoG;YACpG,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,0BAA0B,CAAC,mBAAmB,EAAE,EAAE,CAAC;gBAC9E,IAAI,CAAC,WAAW,CAAC,QAAQ;oBAAE,SAAS;gBACpC,MAAM,QAAQ,GAAG,+BAA+B,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAClE,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,WAAW,CAAC,GAAG,oEAAoE,QAAQ,oCAAoC,CAAC,CAAC;gBAC1K,CAAC;gBACD,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,kCAAkC,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3G,CAAC;YACD,2EAA2E;YAC3E,4EAA4E;YAC5E,uEAAuE;YACvE,aAAa,CAAC,GAAG,CAAC,8CAA8C,EAAE,4CAA4C,EAAE,CAAC,CAAC;YAClH,sFAAsF;YACtF,sFAAsF;YACtF,wFAAwF;YACxF,sFAAsF;YACtF,wEAAwE;YACxE,aAAa,CAAC,GAAG,CAAC,uCAAuC,EAAE,sCAAsC,EAAE,CAAC,CAAC;YACrG;;;;;;;;eAQG;YACH,aAAa,CAAC,GAAG,CAAC,iCAAiC,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACzF;;;;;;;;;;eAUG;YACH,IAAI,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;gBACtC,aAAa,CAAC,GAAG,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAClE;;;;;;;mBAOG;gBACH,aAAa,CAAC,GAAG,CAAC,gCAAgC,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACxF;;;;mBAIG;gBACH,aAAa,CAAC,GAAG,CAAC,qCAAqC,EAAE,mCAAmC,EAAE,CAAC,CAAC;gBAChG;;;mBAGG;gBACH,aAAa,CAAC,GAAG,CAAC,gDAAgD,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC1H,CAAC;YACD;;;;;;eAMG;YACH,aAAa,CAAC,GAAG,CACf,wCAAwC,EACxC,iCAAiC,CAC/B,gBAAgB,CAAC,cAA8B,EAC/C,8CAA8C,CAC/C,CACF,CAAC;YACF,aAAa,CAAC,GAAG,CACf,6CAA6C,EAC7C,iCAAiC,CAC/B,gBAAgB,CAAC,mBAAmC,EACpD,mDAAmD,CACpD,CACF,CAAC;YACF,oGAAoG;YACpG,mGAAmG;YACnG,qGAAqG;YACrG,oGAAoG;YACpG,mGAAmG;YACnG,kGAAkG;YAClG,sGAAsG;YACtG,sGAAsG;YACtG,mGAAmG;YACnG,qGAAqG;YACrG,oGAAoG;YACpG,uBAAuB;YACvB,gGAAgG;YAChG,iDAAiD;YACjD,IAAI,iBAAiB,IAAI,cAAc,CAAC,wBAAwB,EAAE,CAAC;gBAC/D,aAAa,CAAC,GAAG,CAAC,+BAA+B,EAAE,8BAA8B,EAAE,CAAC,CAAC;gBACrF,kGAAkG;gBAClG,yEAAyE;gBACzE,aAAa,CAAC,GAAG,CAAC,iCAAiC,EAAE,+BAA+B,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,CAAC;YAC1J,CAAC;YACD,8EAA8E;YAC9E,yFAAyF;YACzF,wFAAwF;YACxF,qFAAqF;YACrF,0FAA0F;YAC1F,oEAAoE;YACpE,EAAE;YACF,0FAA0F;YAC1F,+EAA+E;YAC/E,wFAAwF;YACxF,4FAA4F;YAC5F,2FAA2F;YAC3F,IAAI,iBAAiB,EAAE,CAAC;gBACpB,aAAa,CAAC,GAAG,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC;YACpH,CAAC;YACD,uEAAuE;YACvE,qEAAqE;YACrE,mDAAmD;YACnD,yDAAyD;YACzD,kFAAkF;YAClF,wFAAwF;YACxF,0EAA0E;YAC1E,uFAAuF;YACvF,kEAAkE;YAClE,aAAa,CAAC,GAAG,CAAC,kCAAkC,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC3F,aAAa,CAAC,GAAG,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC;YACrE,6DAA6D;YAC7D,qEAAqE;YACrE,qCAAqC;YACrC,4EAA4E;YAC5E,oEAAoE;YACpE,mEAAmE;YACnE,yDAAyD;YACzD,2DAA2D;YAC3D,aAAa,CAAC,GAAG,CAAC,8BAA8B,EAAE,8BAA8B,CAAC,CAAC;YAClF,8FAA8F;YAC9F,8FAA8F;YAC9F,+BAA+B;YAC/B,aAAa,CAAC,GAAG,CAAC,mCAAmC,EAAE,mCAAmC,CAAC,CAAC;YAC5F,aAAa,CAAC,GAAG,CAAC,gCAAgC,EAAE,gCAAgC,CAAC,CAAC;YACtF,0GAA0G;YAC1G,aAAa,CAAC,GAAG,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;YAC9E,aAAa,CAAC,GAAG,CAAC,6BAA6B,EAAE,6BAA6B,CAAC,CAAC;YAChF,qFAAqF;YACrF,aAAa,CAAC,GAAG,CAAC,8BAA8B,EAAE,8BAA8B,CAAC,CAAC;YAClF,aAAa,CAAC,GAAG,CAAC,+BAA+B,EAAE,+BAA+B,CAAC,CAAC;YACpF,+EAA+E;YAC/E,sFAAsF;YACtF,sFAAsF;YACtF,qFAAqF;YACrF,sFAAsF;YACtF,aAAa,CAAC,GAAG,CAAC,6BAA6B,EAAE,6BAA6B,CAAC,CAAC;YAChF,qFAAqF;YACrF,uFAAuF;YACvF,oFAAoF;YACpF,wFAAwF;YACxF,qFAAqF;YACrF,WAAW;YACX,aAAa,CAAC,GAAG,CAAC,2BAA2B,EAAE,2BAA2B,CAAC,CAAC;YAC5E,2EAA2E;YAC3E,+EAA+E;YAC/E,2EAA2E;YAC3E,aAAa,CAAC,GAAG,CAAC,gCAAgC,EAAE,gCAAgC,CAAC,CAAC;YACtF,2DAA2D;YAC3D,mEAAmE;YACnE,4EAA4E;YAC5E,iEAAiE;YACjE,oEAAoE;YACpE,8DAA8D;YAC9D,aAAa;YACb,aAAa,CAAC,GAAG,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;YAE9E,IAAI,iBAAiB,IAAI,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,CAAC;gBACtE,aAAa,CAAC,GAAG,CAAC,mCAAmC,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC7F,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YAED,+EAA+E;YAC/E,IAAI,eAAe,EAAE,OAAO,EAAE,CAAC;gBAC3B,aAAa,CAAC,GAAG,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACpH,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,YAAY,EAAE,eAAe,CAAC,oBAAoB,EAAE,CAAC,CAAC;YACnH,CAAC;YAED,4EAA4E;YAC5E,EAAE;YACF,sEAAsE;YACtE,oEAAoE;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,qEAAqE;YACrE,2CAA2C;YAC3C,IAAI,iBAAiB,EAAE,CAAC;gBACpB,MAAM,iBAAiB,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;gBACxF,IAAI,iBAAiB,EAAE,CAAC;oBACpB,oDAAoD;oBACpD,sDAAsD;oBACtD,6DAA6D;oBAC7D,qDAAqD;oBACrD,sDAAsD;oBACtD,sDAAsD;oBACtD,oDAAoD;oBACpD,oDAAoD;oBACpD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,WAAW,CAAC;oBACxD,MAAM,YAAY,GAAG,iBAAiB,EAAE,0BAA0B;2BAC3D,yCAAyC,CAAC;oBACjD,aAAa,CAAC,GAAG,CACb,sCAAsC,EACtC,oCAAoC,CAAC,YAAY,CAAC,CACrD,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,iDAAiD,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBACvF,CAAC;gBAED,iFAAiF;gBACjF,EAAE;gBACF,4FAA4F;gBAC5F,iFAAiF;gBACjF,6EAA6E;gBAC7E,6EAA6E;gBAC7E,iFAAiF;gBACjF,MAAM,wBAAwB,GAAG,IAAI,CAAC,wBAAwB;qBACzD,gBAAgB,EAAE;qBAClB,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE;oBACnB,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,YAAY,CAExF,CAAC;oBACF,OAAO,aAAa,EAAE,oBAAoB,EAAE,YAAY,KAAK,SAAS,CAAC;gBAC3E,CAAC,CAAC,CAAC;gBACP,IAAI,wBAAwB,EAAE,CAAC;oBAC3B,aAAa,CAAC,GAAG,CACb,8CAA8C,EAC9C,2CAA2C,EAAE,CAChD,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;gBACnE,CAAC;gBAED,wDAAwD;gBACxD,6DAA6D;gBAC7D,yCAAyC;gBACzC,0DAA0D;gBAC1D,6DAA6D;gBAC7D,+CAA+C;gBAC/C,EAAE;gBACF,2DAA2D;gBAC3D,0DAA0D;gBAC1D,uDAAuD;gBACvD,sDAAsD;gBACtD,EAAE;gBACF,yDAAyD;gBACzD,2DAA2D;gBAC3D,oDAAoD;gBACpD,uDAAuD;gBACvD,cAAc;gBACd,MAAM,WAAW,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBACjD,IAAI,WAAW,EAAE,CAAC;oBACd,aAAa,CAAC,GAAG,CACb,kCAAkC,EAClC,gCAAgC,EAAE,CACrC,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;YAElD,oGAAoG;YACpG,oGAAoG;YACpG,8FAA8F;YAC9F,oFAAoF;YACpF,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,sBAAsB,EAAE,cAAc,CAAC,CAAC;YAE5E,mFAAmF;YACnF,IAAI,IAAI,CAAC,0BAA0B,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;gBACpD,0EAA0E;gBAC1E,yEAAyE;gBACzE,4EAA4E;gBAC5E,6EAA6E;gBAC7E,0EAA0E;gBAC1E,sDAAsD;gBACtD,IAAI,SAAS,EAAE,CAAC;oBACZ,IAAI,CAAC;wBACD,MAAM,0BAA0B,GAAG,SAAS,CAAC,GAAG,CAC5C,kBAAkB,CAAC,0BAA0B,CACX,CAAC;wBACvC,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;wBAC5E,IAAI,CAAC,QAAQ,CAAC,4DAA4D,CAAC,CAAC;wBAE5E,uEAAuE;wBACvE,sEAAsE;wBACtE,2DAA2D;wBAC3D,MAAM,2BAA2B,GAAG,SAAS,CAAC,GAAG,CAC7C,kBAAkB,CAAC,2BAA2B,CACX,CAAC;wBACxC,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;wBAC7E,IAAI,CAAC,QAAQ,CAAC,6DAA6D,CAAC,CAAC;oBACjF,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uFAAuF,EAAE;4BACtG,GAAG,2BAA2B,CAAC,KAAK,CAAC;yBACxC,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBACnD,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAC/D,CAAC;iBAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC7B,IAAI,CAAC,QAAQ,CAAC,wFAAwF,CAAC,CAAC;YAC5G,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YAED,mEAAmE;YACnE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACrD,IAAI,CAAC;oBACD,8DAA8D;oBAC9D,4DAA4D;oBAC5D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,8DAA8D;oBAC9D,6DAA6D;oBAC7D,iDAAiD;oBACjD,MAAM,IAAI,CAAC,sBAAsB,CAAC,UAAU,CACxC,gBAAgB;wBACZ,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;wBACvD,CAAC,CAAC,SAAS,CAClB,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;gBAC7E,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,4DAA4D;oBAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,KAAK,CAAC,CAAC;gBACjF,CAAC;gBAED,uDAAuD;gBACvD,IAAI,IAAI,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;oBAChE,IAAI,CAAC;wBACD,8BAA8B;wBAC9B,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;wBAErC,2EAA2E;wBAC3E,sEAAsE;wBACtE,4EAA4E;wBAC5E,wEAAwE;wBACxE,qEAAqE;wBACrE,2EAA2E;wBAC3E,qCAAqC;wBACrC,KAAK,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;4BAC1E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;wBACrG,CAAC,CAAC,CAAC;oBACP,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACb,wDAAwD;wBACxD,uEAAuE;wBACvE,wCAAwC;wBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;oBAClE,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,IAAI,CAAC,QAAQ,CAAC,iDAAiD,CAAC,CAAC;gBACrE,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;YAED;;;;;;;;;;;;;eAaG;YACH,MAAM,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAE1C,iGAAiG;YACjG,uGAAuG;YACvG,oEAAoE;YACpE,oEAAoE;YACpE,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAEhC,kFAAkF;YAClF,wFAAwF;YACxF,2BAA2B;YAC3B,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEnC,uFAAuF;YACvF,uFAAuF;YACvF,kFAAkF;YAClF,0DAA0D;YAC1D,MAAM,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAE1C,yFAAyF;YACzF,sFAAsF;YACtF,wFAAwF;YACxF,4DAA4D;YAC5D,MAAM,IAAI,CAAC,kCAAkC,EAAE,CAAC;YAEhD,iFAAiF;YACjF,0FAA0F;YAC1F,kFAAkF;YAClF,MAAM,IAAI,CAAC,gCAAgC,EAAE,CAAC;YAE9C,yFAAyF;YACzF,2FAA2F;YAC3F,yFAAyF;YACzF,yDAAyD;YACzD,IAAI,CAAC,yCAAyC,EAAE,CAAC;YAEjD,4GAA4G;YAC5G,2FAA2F;YAC3F,6EAA6E;YAC7E,MAAM,IAAI,CAAC,mCAAmC,CAC1C,SAAS,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,CAAC;gBACxD,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,mBAAmB,CAA+B;gBACrF,CAAC,CAAC,SAAS,CAClB,CAAC;YAEF,kCAAkC;YAClC,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;YAEpD,sFAAsF;YACtF,wFAAwF;YACxF,wFAAwF;YACxF,wFAAwF;YACxF,yFAAyF;YACzF,oEAAoE;YACpE,EAAE;YACF,2FAA2F;YAC3F,0FAA0F;YAC1F,wFAAwF;YACxF,uFAAuF;YACvF,yFAAyF;YACzF,wFAAwF;YACxF,yFAAyF;YACzF,4FAA4F;YAC5F,wFAAwF;YACxF,EAAE;YACF,iGAAiG;YACjG,+FAA+F;YAC/F,wFAAwF;YACxF,IAAI,iBAAiB,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC9D,wFAAwF;gBACxF,gGAAgG;gBAChG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wCAAwC,CAAC;oBACjE,SAAS,EAAE,iBAAiB,CAAC,SAAS;oBACtC,0BAA0B,EAAE,iBAAiB,CAAC,UAAU,EAAE,qBAAqB;iBAClF,CAAC,CAAC;YACP,CAAC;YAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAG1B,uEAAuE;YACvE,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YAC/D,IAAI,CAAC,2BAA2B,CAAC;gBAC7B,mBAAmB,EAAE,IAAI;gBACzB,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,CAAC;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC;YACpD,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAEpC,IAAI,CAAC,QAAQ,CAAC,8DAA8D,CAAC,CAAC;QAElF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,sEAAsE;YACtE,oEAAoE;YACpE,0DAA0D;YAC1D,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH;;;;OAIG;IACK,uBAAuB,CAAC,SAAc,EAAE,gBAA6C;QACzF,wGAAwG;QACxG,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAA0C,EAAE,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;QACxI,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACzE,wGAAwG;QACxG,wEAAwE;QACxE,MAAM,kBAAkB,GAAG,IAAI,CAAC,8BAA8B,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtG,IAAI,kBAAkB;YAAE,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,6BAA6B,CAAyC,CAAC;QACzH,MAAM,uBAAuB,GAAG,IAAI,CAAC,8BAA8B,CAAC;QACpE,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAA6B,CAAC;QACvE,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAoC,CAAC;QAC3E,KAAK,MAAM,QAAQ,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACjI,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,kBAAkB,CAAC,CAAC;YAChJ,MAAM,aAAa,GAAG,OAAO;gBACzB,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,wBAAwB,CAAC,WAAW,EAAE,sCAAsC,CAAC,kBAAkB,CAAyD;gBAChM,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,SAAS,GAAG,aAAa,EAAE,SAAS,IAAI,EAAE,CAAC;YACjD,2FAA2F;YAC3F,mEAAmE;YACnE,yBAAyB,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACtF,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACvD,CAAC;QACD,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE;YAC/B,yBAAyB;YACzB,iGAAiG;YACjG,oEAAoE;YACpE,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,KAAK,CAAC;SACpG,CAAC,CAAC;QAEH,MAAM,qBAAqB,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAwC,CAAC;QAC7H,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,CAAC,iBAAiB;gBAAE,SAAS;YAC1E,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACpD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC;YAC7G,IAAI,QAAQ,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9E,MAAM,IAAI,8BAA8B,CACpC,YAAY,OAAO,CAAC,GAAG,YAAY,WAAW,IAAI,WAAW,iBAAiB,QAAQ,CAAC,UAAU,qEAAqE,CACzK,CAAC;YACN,CAAC;QACL,CAAC;QACD,IAAI,CAAC,8BAA8B,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;QAC3F,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,8BAA8B,CAClC,SAAc,EACd,QAA8C,EAC9C,gBAAwD,EACxD,eAAqD;QAErD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,oCAAoC,CAAgD,CAAC;QACvI,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,4BAA4B,CAAwC,CAAC;QACtH,MAAM,mBAAmB,GAAG,IAAI,CAAC,gCAAgC,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC5H,MAAM,oBAAoB,GAAG,IAAI,CAAC,gCAAgC,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACzI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE;YAC/D,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC7G,mBAAmB,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5E,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,IAAa,EAAE,KAAK,CAAC;SACpG,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,oBAAoB;YAAE,OAAO;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,gCAAgC,CAAC,0BAA0B,CAAC,oBAAoB,EAAE,sCAAsC,CAAC,sBAAsB,CAAqD,CAAC;QAC3N,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,8BAA8B,CAAC,+BAA+B,oBAAoB,2FAA2F,CAAC,CAAC;QAC7L,CAAC;QACD,QAAQ,CAAC,4BAA4B,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACzE,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,CAAC,uBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC;IACjI,CAAC;IAED;;;;OAIG;IACK,8BAA8B,CAAC,SAAc,EAAE,uBAAgC;QACnF,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,2BAA2B,CAAuC,CAAC;QACrH,iGAAiG;QACjG,MAAM,kBAAkB,GAAG,IAAI,CAAC,gCAAgC,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAC7I,IAAI,kBAAkB,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,gCAAgC,CAAC,0BAA0B,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,cAAc,CAAuD,CAAC;YAClN,iDAAiD,CAAC;gBAC9C,WAAW,EAAE,kBAAkB;gBAC/B,UAAU,EAAE,OAAO,EAAE,yBAAyB;gBAC9C,WAAW,EAAE,wCAAwC,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;aAC5G,CAAC,CAAC;QACP,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE;YAAE,OAAO,IAAI,CAAC;QACvC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC7B,IAAI,CAAC,uBAAuB;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,gCAAgC,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,aAAa,CAAE,CAAC;QACjI,MAAM,QAAQ,GAAG,IAAI,CAAC,gCAAgC,CAAC,0BAA0B,CAAC,WAAW,EAAE,sCAAsC,CAAC,sBAAsB,CAAqD,CAAC;QAClN,IAAI,CAAC,QAAQ,EAAE,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,8BAA8B,CAAC,+BAA+B,WAAW,2FAA2F,CAAC,CAAC;QACpL,CAAC;QACD,OAAO,qCAAqC,CAAC;YACzC,WAAW;YACX,WAAW,EAAE,QAAQ,CAAC,uBAAuB;YAC7C,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,4BAA4B,CAAwC;SACnH,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,+BAA+B,CAAC,SAAc;QACxD,MAAM,OAAO,GAAG;YACZ,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,6BAA6B,CAAyC;YACjH,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,8BAA8B,CAA0C;SACtH,CAAC;QACF,iGAAiG;QACjG,6EAA6E;QAC5E,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAyC,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACpI,IAAI,CAAC;YACD,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAiC,CAAC;YAC/G,MAAM,qBAAqB,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAwC,CAAC;YAE7H,MAAM,qBAAqB,CAAC,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,uEAAuE;YACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBAC/D,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACxC,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,yBAAyB,CACnC,SAAc,EACd,aAAmC,EACnC,qBAA2C;QAE3C,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAErD,+DAA+D;QAC/D,EAAE;QACF,4DAA4D;QAC5D,iEAAiE;QACjE,mEAAmE;QACnE,+DAA+D;QAC/D,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,0DAA0D;QAC1D,sDAAsD;QACtD,iEAAiE;QACjE,EAAE;QACF,iEAAiE;QACjE,mEAAmE;QACnE,6DAA6D;QAC7D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC;QACpE,kGAAkG;QAClG,iGAAiG;QACjG,IAAI,UAAU,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACnE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACL,OAAO,EAAE,wCAAwC,CAC7C,UAAU,CAAC,MAAM,EACjB,aAAa,EACb,UAAU,CAAC,MAAM,CACpB;oBACD,WAAW,EAAE,aAAa,CAAC,WAAW,IAAI,IAAI;oBAC9C,uBAAuB,EAAE,UAAU,CAAC,MAAM;iBAC7C;aACJ,CAAC,CAAC;QACP,CAAC;QACD,kGAAkG;QAClG,MAAM,kBAAkB,GAAG,UAAU,CAAC,WAAW,CAAC;QAClD,mHAAmH;QACnH,iHAAiH;QACjH,+GAA+G;QAC/G,MAAM,sBAAsB,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,8BAA8B,CAAC;YAClG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,8BAA8B,CAAiD;YAClH,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,eAAe,GAAG,sBAAsB,KAAK,SAAS;YACxD,CAAC,CAAC,UAAU,CAAC,QAAQ;YACrB,CAAC,CAAC,0BAA0B,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC7H,6HAA6H;QAC7H,iIAAiI;QACjI,0HAA0H;QAC1H,IAAI,0BAA0B,GAA+C,IAAI,CAAC;QAElF,IAAI,CAAC;YACD,4CAA4C;YAC5C,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,yBAAyB,CAAqC,CAAC;YACpH,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,CAAgC,CAAC;YAC5G,MAAM,qBAAqB,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,4BAA4B,CAAwC,CAAC;YAEpI,0FAA0F;YAC1F,MAAM,kBAAkB,GAAwB,qBAAqB,IAAI,EAAE,CAAC;YAE5E,6CAA6C;YAC7C,MAAM,WAAW,CAAC,UAAU,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;YAClE,MAAM,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAChD,iHAAiH;YACjH,mHAAmH;YACnH,iFAAiF;YACjF,MAAM,sBAAsB,GAAG,IAAI,qCAAqC,CAAC;gBACrE,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;gBACtD,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,oCAAoC,CAAgD;gBACjI,aAAa,EAAE,GAAG,EAAE,CAAC,mCAAmC,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBAC/E,WAAW,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,WAAW;aAC/C,CAAC,CAAC;YACH,mHAAmH;YACnH,iHAAiH;YACjH,oBAAoB;YACpB,MAAM,qBAAqB,CAAC,UAAU,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;YAChF,iFAAiF;YAChF,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,0CAA0C,CAAuD;iBAC9H,UAAU,CAAC,eAAe,CAAC,CAAC;YACjC;;;;;;eAMG;YACH,uBAAuB,CAAC,aAAa,CAAC,CAAC;YACvC,iGAAiG;YACjG,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,sBAAsB,CAAkC,CAAC,CAAC;YAErH,0DAA0D;YAC1D,EAAE;YACF,wFAAwF;YACxF,0FAA0F;YAC1F,wFAAwF;YACxF,uFAAuF;YACvF,qEAAqE;YACrE,SAAS;iBACJ,GAAG,CAAC,kBAAkB,CAAC,oCAAoC,CAAC;iBAC5D,QAAQ,CAAC,iCAAiC,CAAC;gBACxC,kBAAkB;gBAClB,kBAAkB,EAAE,GAAG,EAAE,CAAC,eAAe;gBACzC,6BAA6B,EAAE,KAAK,EAAE,0BAA0B,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE;oBAC5F,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,mBAAmB,CAA+B,CAAC;oBACzG,OAAO,yBAAyB,CAAC,MAAM,YAAY,CAAC,YAAY,CAC5D,0BAA0B,EAC1B,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,CAC5C,CAAwD,CAAC;gBAC9D,CAAC;gBACD,uBAAuB,EAAE,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,EAAE;oBACjG,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,mBAAmB,CAA+B,CAAC;oBACzG,OAAO,yBAAyB,CAAC,MAAM,YAAY,CAAC,YAAY,CAC5D,wBAAwB,EACxB;wBACI,CAAC,qBAAqB,CAAC,EAAE,gBAAgB;wBACzC,MAAM,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE;qBACnD,CACJ,CAA4D,CAAC;gBAClE,CAAC;gBACD,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;gBACjE;;;;;;;;;mBASG;gBACH,4BAA4B,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,wBAAwB;qBAC5D,gBAAgB,EAAE;qBAClB,QAAQ,CAAC,yBAAyB,CAAC,MAAM,CAAC,cAA8B,CAAC;aACjF,CAAC,CAAC,CAAC;YACR,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;YAE9D,4GAA4G;YAC5G,IAAI,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBAC1D,IAAI,CAAC,QAAQ,CAAC,sCAAsC,EAAE;oBAClD,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,MAAM;iBACjD,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;oBACnE,GAAG,2BAA2B,CAAC,SAAS,CAAC;iBAC5C,CAAC,CAAC;YACP,CAAC;YAED,+FAA+F;YAC/F,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,yBAAyB,CAAqC,CAAC;YACpH,MAAM,mBAAmB,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,mBAAmB,CAA+B,CAAC;YAChH,sCAAsC,CAAC,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;YAEhJ,oGAAoG;YACpG,iCAAiC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAEhE,yGAAyG;YACzG,2GAA2G;YAC3G,sGAAsG;YACtG,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,qBAAqB,CAAiC,CAAC;YAC/G,MAAM,cAAc,GAAG,IAAI,qBAAqB,CAAC,eAAe,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;YAC7F,cAAc,CAAC,eAAe,CAAC,aAAa,CAAC,WAAW,EAAE,4BAA4B,EAAE,cAAc,CAAC,CAAC;YAExG,MAAM,gBAAgB,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,CAAqB,CAAC;YAChG,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;YAC7C,MAAM,kBAAkB,GAAG,IAAI,uCAAuC,CAAC,IAAI,CAAC,uBAAuB,EAAE,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,2BAA2B,EAAE,sBAAsB,CAAC,CAAC;YAC7N,MAAM,eAAe,GAAG,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,CAAC,aAAa,CAAC,WAAW,EAAE,sCAAsC,CAAC,kBAAkB,CAAC;gBACjK,CAAC,CAAE,IAAI,CAAC,gCAAgC,CAAC,wBAAwB,CAAC,aAAa,CAAC,WAAW,EAAE,sCAAsC,CAAC,kBAAkB,CAA0D;oBAC5M,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,4BAA4B,CAAC;gBAClF,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,eAAe,EAAE,CAAC;gBAClB,0BAA0B,GAAG,GAAG,EAAE,CAAC,2BAA2B,CAAC;oBAC3D,WAAW,EAAE,aAAa,CAAC,WAAW;oBACtC,QAAQ,EAAE,eAAe;oBACzB,eAAe;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,qCAAqC,CAAC,iCAAiC,CAAC,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC;oBAC3K,oBAAoB,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,YAA4B,CAAC,KAAK,SAAS;iBACrI,CAAC,CAAC;YACP,CAAC;iBAAM,CAAC;gBACJ,uGAAuG;gBACvG,oGAAoG;gBACpG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,aAAa,CAAC,WAAW,0BAA0B,4BAA4B,0DAA0D,CAAC,CAAC;YACtL,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE;gBACzD,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,aAAa,EAAE,aAAa,CAAC,aAAa;aAC7C,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,qFAAqF;YACrF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,EAAE;gBACxF,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACxC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,sBAAsB,CAAC,aAAmC;QACpE,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;YACnD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,CAAC,kBAAkB,EAAE,CAAC;QAClG,CAAC;QAED,IAAI,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,8BAA8B,CAAC,kBAAkB,CAC1E,WAAW,EACX,sCAAsC,CAAC,gBAAgB,CAC1D,CAAC;YACF,IAAI,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;gBAChE,kEAAkE;gBAClE,iEAAiE;gBACjE,mEAAmE;gBACnE,mEAAmE;gBACnE,iEAAiE;gBACjE,IAAI,CAAC,QAAQ,CAAC,uDAAuD,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;gBACxF,OAAO;oBACH,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,sCAAsC,CAAC,iCAAiC;iBACnF,CAAC;YACN,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,CACxD,WAAW,EACX,sCAAsC,CAAC,gBAAgB,CAC1D,EAAE,CAAC;gBACA,IAAI,CAAC,QAAQ,CAAC,8DAA8D,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC/F,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,CAAC,iBAAiB,EAAE,CAAC;YACjG,CAAC;YAED,uFAAuF;YACvF,wFAAwF;YACxF,wFAAwF;YACxF,gDAAgD;YAChD,EAAE;YACF,qFAAqF;YACrF,iFAAiF;YACjF,wFAAwF;YACxF,gEAAgE;YAChE,6EAA6E;YAC7E,EAAE;YACF,8FAA8F;YAC9F,2FAA2F;YAC3F,wFAAwF;YACxF,8EAA8E;YAC9E,MAAM,cAAc,GAAG,4BAA4B,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YAChF,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0EAA0E,EAAE;oBACzF,WAAW;oBACX,UAAU,EAAE,eAAe,CAAC,UAAU;oBACtC,SAAS,EAAE,+BAA+B,EAAE;iBAC/C,CAAC,CAAC;gBACH,OAAO;oBACH,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,sCAAsC,CAAC,0BAA0B;oBACzE,MAAM,EAAE,eAAe,CAAC,UAAU;iBACrC,CAAC;YACN,CAAC;YAED,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC;YAC5C,MAAM,SAAS,GAAG,SAAS;gBACvB,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,CACrD,WAAW,EACX,sCAAsC,CAAC,gBAAgB,EACvD,SAAS,CACZ;gBACD,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;gBAClG,OAAO;oBACH,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,sCAAsC,CAAC,cAAc;oBAC7D,MAAM,EAAE,SAAS;iBACpB,CAAC;YACN,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,qEAAqE,EAAE;gBACjF,WAAW;gBACX,UAAU,EAAE,eAAe,CAAC,UAAU;aACzC,CAAC,CAAC;YACH,OAAO;gBACH,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC;gBAC/E,WAAW;aACd,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACvF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QACxG,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ;QACV,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QAG5C,uEAAuE;QACvE,oEAAoE;QACpE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC;QAEnC,4DAA4D;QAC5D,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAY,CAAC,CAAC;QAC1E,CAAC;IACL,CAAC;IACD;;OAEG;IACI,wBAAwB;QAC3B,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,YAAY;QACrB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;IACxC,CAAC;IAED;;OAEG;IACI,oBAAoB;QACvB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,EAAE,CAAC;IAChE,CAAC;IAED;;OAEG;IACI,uBAAuB;QAC1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,2BAA2B,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACI,2BAA2B,CAAC,UAM/B,EAAE;QACF,IAAI,CAAC,QAAQ,CAAC,0DAA0D,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,oEAAoE,CAAC,CAAC;YACpF,OAAO;QACX,CAAC;QAED,IAAI,CAAC,2BAA2B,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACI,uBAAuB;QAC1B,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC,CAAC;QAEnE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,oEAAoE,CAAC,CAAC;YACpF,OAAO;QACX,CAAC;QAED,IAAI,CAAC,2BAA2B,CAAC,uBAAuB,EAAE,CAAC;IAC/D,CAAC;IAED;;OAEG;IACI,4BAA4B;QAC/B,IAAI,CAAC,QAAQ,CAAC,qDAAqD,CAAC,CAAC;QAErE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO;QACX,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,EAAE,CAAC;IACvD,CAAC;IAED;;OAEG;IACI,sBAAsB;QACzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,0BAA0B,CAAC;IAC3C,CAAC;IAED;;OAEG;IACI,mBAAmB;QACtB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,uBAAuB,CAAC;IACxC,CAAC;IAED;;OAEG;IACI,aAAa;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAED;;OAEG;IACI,wBAAwB;QAC3B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACO,mBAAmB,CACzB,SAAoD,EACpD,sBAAmF,EACnF,iBAA4C,yBAAyB,CAAC,mBAAmB;QAEzF,2BAA2B,CAAC;YACxB,SAAS;YACT,sBAAsB;YACtB;;;;;;;eAOG;YACH,yBAAyB,EACrB,cAAc,KAAK,yBAAyB,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,cAAc;YAC5F,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,uBAAuB;YACtC,qBAAqB,EAAE,IAAI,CAAC,oCAAoC;YAChE,UAAU,EAAE,IAAI,CAAC,yBAAyB;YAC1C,gBAAgB,EAAE,IAAI,CAAC,uBAAuB;SACjD,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;OAYG;IACH;;;;;OAKG;IACO,KAAK,CAAC,4BAA4B;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE;YACrD,mBAAmB,EAAE,QAAQ,CAAC,GAAG;YACjC,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC5B,CAAC,CAAC;IACP,CAAC;IAES,KAAK,CAAC,kBAAkB;QAC9B,MAAM,wCAAwC,CAAC;YAC3C,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,yBAAyB;SAC7C,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACO,KAAK,CAAC,qBAAqB;QACjC,oFAAoF;QACpF,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC;;;;;;;;;;;;WAYG;QACH,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,qCAAqC;YAAE,OAAO;QAE/H,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,QAAQ,CAAC,kFAAkF,CAAC,CAAC;gBAClG,OAAO;YACX,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,qCAAqC,CAAC,0BAA0B,CAAC;gBACjG,SAAS,EAAE,IAAI,CAAC,wBAAwB,CAAC,8BAA8B,CACnE,gBAAgB,CAAC,KAAK,EACtB,qBAAqB,CAAC,IAAI,CAC7B;gBACD,cAAc,EAAE;oBACZ;wBACI,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;wBAC7C,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;qBACxD;iBACJ;aACJ,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,iCAAiC,CAAC;gBACvD,gBAAgB;gBAChB,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;gBACtD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,eAAe,EAAE,gCAAgC,CAAC,IAAI,CAAC,qBAAqB,CAAC;aAChF,CAAC,CAAC;YAEH,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE;oBACjD,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;iBAC1D,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,uFAAuF;YACvF,kFAAkF;YAClF,sFAAsF;YACtF,kBAAkB;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,mFAAmF;kBACjF,kFAAkF;kBAClF,oFAAoF;kBACpF,gDAAgD,EAClD;gBACI,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;gBACvD,6BAA6B,EAAE,yBAAyB;gBACxD,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,cAAc,EAAE,CAAC,GAAG,qCAAqC,CAAC;aAC7D,CACJ,CAAC;YAEF,MAAM,IAAI,CAAC,gBAAgB,EAAE,qCAAqC,CAAC;gBAC/D,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;gBACvD,6BAA6B,EAAE,yBAAyB;gBACxD,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,cAAc,EAAE,CAAC,GAAG,qCAAqC,CAAC;aAC7D,EAAE,gBAAgB,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,uEAAuE;YACvE,IAAI,CAAC,QAAQ,CAAC,gDAAgD,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACO,KAAK,CAAC,4BAA4B;QACxC,0EAA0E;QAC1E,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC;;;;;;;;;;;;WAYG;QACH,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,qCAAqC;YAAE,OAAO;QAE/H,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC;mBAC5E,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC5F,IAAI,CAAC,QAAQ,CAAC,4FAA4F,CAAC,CAAC;gBAC5G,OAAO;YACX,CAAC;YAED,MAAM,2BAA2B,GAAG,IAAI,CAAC,2BAA2B,CAAC;YACrE,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,CAAC,+FAA+F,CAAC,CAAC;gBAC/G,OAAO;YACX,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,sCAAsC,CAAC;gBAC5D,mFAAmF;gBACnF,yFAAyF;gBACzF,wFAAwF;gBACxF,wEAAwE;gBACxE,4CAA4C;gBAC5C,2BAA2B;gBAC3B,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;gBACtD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,eAAe,EAAE,uCAAuC,CAAC,IAAI,CAAC,qBAAqB,CAAC;aACvF,CAAC,CAAC;YAEH,yFAAyF;YACzF,yFAAyF;YACzF,yFAAyF;YACzF,sFAAsF;YACtF,yEAAyE;YACzE,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,sFAAsF;sBACpF,uFAAuF;sBACvF,kFAAkF,EACpF;oBACI,4BAA4B,EAAE,UAAU,CAAC,wBAAwB,CAAC,MAAM;oBACxE,wBAAwB,EAAE,UAAU,CAAC,wBAAwB;oBAC7D,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;iBACpE,CACJ,CAAC;YACN,CAAC;YAED,IAAI,UAAU,CAAC,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,QAAQ,CAAC,+DAA+D,EAAE;oBAC3E,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;iBACpE,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,yFAAyF;YACzF,yFAAyF;YACzF,0FAA0F;YAC1F,2FAA2F;YAC3F,sDAAsD;YACtD,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,oFAAoF;kBAClF,oFAAoF;kBACpF,8DAA8D;kBAC9D,wFAAwF;kBACxF,qFAAqF;kBACrF,4DAA4D,EAC9D;gBACI,0BAA0B,EAAE,UAAU,CAAC,sBAAsB,CAAC,MAAM;gBACpE,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;gBACjE,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;gBACzD,oBAAoB,EAAE,gCAAgC;gBACtD,eAAe,EAAE,uCAAuC,CAAC,IAAI,CAAC,qBAAqB,CAAC;gBACpF,wBAAwB,EAAE,CAAC,GAAG,oDAAoD,CAAC;gBACnF,uBAAuB,EAAE,CAAC,GAAG,2CAA2C,CAAC;aAC5E,CACJ,CAAC;YAEF;;;;;;;;;;;;;;;;;eAiBG;YACH,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;gBACvD,IAAI,CAAC;oBACD,MAAM,IAAI,CAAC,gBAAgB,EAAE,iCAAiC,CAAC;wBAC3D,cAAc,EAAE,QAAQ,CAAC,cAAc;wBACvC,UAAU,EAAE,uCAAuC,CAAC,WAAW;wBAC/D,qBAAqB,EAAE,CAAC;wBAC5B,8EAA8E;qBAC7E,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,QAAQ,CACT,0EAA0E,EAC1E,2BAA2B,CAAC,KAAK,CAAC,CACrC,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,uEAAuE;YACvE,IAAI,CAAC,QAAQ,CAAC,+CAA+C,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QACvG,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACO,KAAK,CAAC,kCAAkC;QAC9C,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,qCAAqC;YAAE,OAAO;QAE/H,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC;gBAClF,IAAI,CAAC,QAAQ,CAAC,+FAA+F,CAAC,CAAC;gBAC/G,OAAO;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oCAAoC,CAAC;YAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,IAAI,CAAC,QAAQ,CAAC,+EAA+E,CAAC,CAAC;gBAC/F,OAAO;YACX,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,4BAA4B,EAAE,CAAC;YAC1D,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,kEAAkE;YAE1F,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,CAAC,yCAAyC,EAAE;oBACrD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,cAAc;oBAC/C,gBAAgB,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB;iBACtD,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,IAAI,UAAU,CAAC,OAAO,KAAK,mCAAmC,CAAC,OAAO,EAAE,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,qGAAqG;sBACnG,iGAAiG;sBACjG,oGAAoG;sBACpG,0FAA0F,EAC5F;oBACI,qBAAqB,EAAE,SAAS;oBAChC,oFAAoF;oBACpF,oFAAoF;oBACpF,oFAAoF;oBACpF,eAAe,EAAE,UAAU,CAAC,wBAAwB,IAAI,EAAE;iBAC7D,CACJ,CAAC;gBACF,OAAO;YACX,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,0GAA0G;kBACxG,wGAAwG;kBACxG,kGAAkG,EACpG,EAAE,qBAAqB,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CACpE,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,uEAAuE;YACvE,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7G,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACO,KAAK,CAAC,gCAAgC;QAC5C,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,qCAAqC;YAAE,OAAO;QAE/H,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,QAAQ,CAAC,qFAAqF,CAAC,CAAC;gBACrG,OAAO;YACX,CAAC;YACD,MAAM,2BAA2B,GAAG,IAAI,CAAC,2BAA2B,CAAC;YACrE,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,CAAC,mGAAmG,CAAC,CAAC;gBACnH,OAAO;YACX,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAAC;gBACzD,2BAA2B;gBAC3B,oBAAoB,EAAE,IAAI,CAAC,2BAA2B;gBACtD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,+BAA+B,EAAE,gCAAgC,CAAC,IAAI,CAAC,qBAAqB,CAAC;gBAC7F,gCAAgC,EAAE,uCAAuC,CAAC,IAAI,CAAC,qBAAqB,CAAC;gBACrG,0EAA0E;gBAC1E,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACvC,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE;gBACnD,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,2BAA2B,EAAE,UAAU,CAAC,uBAAuB,CAAC,MAAM;gBACtE,4BAA4B,EAAE,UAAU,CAAC,wBAAwB,CAAC,MAAM;gBACxE,+BAA+B,EAAE,UAAU,CAAC,+BAA+B;gBAC3E,gCAAgC,EAAE,UAAU,CAAC,gCAAgC;aAChF,CAAC,CAAC;YAEH,oFAAoF;YACpF,uFAAuF;YACvF,mFAAmF;YACnF,IAAI,UAAU,CAAC,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,sGAAsG;sBACpG,oGAAoG;sBACpG,0CAA0C,EAC5C,EAAE,yBAAyB,EAAE,UAAU,CAAC,yBAAyB,EAAE,CACtE,CAAC;YACN,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3G,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACO,KAAK,CAAC,mCAAmC,CAAC,YAAoD;QACpG,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,oCAAoC;YAAE,OAAO;QAE9H,IAAI,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,CAAC,wFAAwF,CAAC,CAAC;gBACxG,OAAO;YACX,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,oCAAoC,CAAC;gBACtD,YAAY;gBACZ,QAAQ,EAAE,IAAI,CAAC,gCAAgC;gBAC/C,UAAU,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;aACtG,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,0GAA0G;sBACxG,2GAA2G;sBAC3G,gEAAgE;sBAChE,gGAAgG;sBAChG,8FAA8F;sBAC9F,sGAAsG;sBACtG,uCAAuC,EACzC;oBACI,mBAAmB,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAChG,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;iBAC9C,CACJ,CAAC;YACN,CAAC;YAED,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,2GAA2G;sBACzG,yGAAyG;sBACzG,gCAAgC,EAClC;oBACI,4BAA4B,EAAE,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAClH,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;oBACnD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;iBAC9C,CACJ,CAAC;YACN,CAAC;YAED,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChF,IAAI,CAAC,QAAQ,CAAC,kFAAkF,EAAE;oBAC9F,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;iBAC9C,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,sDAAsD,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9G,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACK,yCAAyC;QAC7C,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,EAAE,oBAAoB,EAAE,CAAC;YACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,IAAI,CAAC,QAAQ,CAAC,wFAAwF,CAAC,CAAC;gBACxG,OAAO;YACX,CAAC;YAED,MAAM,UAAU,GAAG,wDAAwD,CAAC;gBACxE,sBAAsB,EAAE,QAAQ,CAAC,sBAAmF;gBACpH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;aAC9D,CAAC,CAAC;YAEH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,oEAAoE,EAAE;oBAChF,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,CAAC,MAAM;iBACrE,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,6FAA6F;kBAC3F,6FAA6F;kBAC7F,yFAAyF;kBACzF,4FAA4F;kBAC5F,0FAA0F;kBAC1F,2FAA2F;kBAC3F,yCAAyC,EAC3C;gBACI,uBAAuB,EAAE,UAAU,CAAC,MAAM;gBAC1C,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,CAAC,MAAM;gBAClE,mBAAmB,EAAE,UAAU;aAClC,CACJ,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,6FAA6F;YAC7F,IAAI,CAAC,QAAQ,CAAC,gDAAgD,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAAC,UAAsC,EAAE;QACzE,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;QAE1D,IAAI,CAAC;YACD,oCAAoC;YACpC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACV,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CACtC,SAAS,CAAC,aAAa,EACvB,SAAS,EACT,EAAC,sBAAsB,EAAE,2BAA2B,CAAC,sCAAsC,EAAC,CAC/F,CAAC;oBACF,MAAM,KAAK,CAAC;gBAChB,CAAC;YACL,CAAC;YAED,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,EAAE,CAAC;YACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CACtC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAC,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC,EAAC,CAChG,CAAC;gBACF,MAAM,KAAK,CAAC;YAChB,CAAC;YAED,+CAA+C;YAC/C,iFAAiF;YACjF,8CAA8C;YAC9C,mEAAmE;YACnE,IAAI;YAEJ,2CAA2C;YAC3C,yEAAyE;YACzE,0CAA0C;YAC1C,+DAA+D;YAC/D,IAAI;YAEJ,8CAA8C;YAC9C,+EAA+E;YAC/E,6CAA6C;YAC7C,kEAAkE;YAClE,IAAI;YAEJ,qCAAqC;YACrC,6CAA6C;YAC7C,qDAAqD;YACrD,IAAI;YAEJ,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY;gBACnC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC;YAE7C,sEAAsE;YACtE,2CAA2C;YAC3C,gDAAgD;YAChD,2EAA2E;YAC3E,gEAAgE;YAChE,6EAA6E;YAC7E,qDAAqD;YACrD,qEAAqE;YACrE,8DAA8D;YAC9D,2EAA2E;YAC3E,qDAAqD;YACrD,6DAA6D;YAC7D,oCAAoC;YACpC,mCAAmC;YACnC,MAAM;QAEV,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,qEAAqE;YACrE,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;OAEG;IACK,iBAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CACtC,SAAS,CAAC,QAAQ,EAClB,SAAS,EACT,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,gCAAgC,EAAE,CAC3F,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAES,0BAA0B,CAAC,OAAmC;QACpE,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IACzD,CAAC;IAES,kBAAkB,CAAC,OAAmC;QAC5D,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IACzD,CAAC;IAEO,gCAAgC,CAAC,SAAc,EAAE,QAA+C;QACpG,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACvD,OAAO;QACX,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClG,CAAC;CACJ,CAAA;AA/tGY,8BAA8B;IAD1C,UAAU,EAAE;IAcJ,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,wCAAwC,CAAC,CAAA;IACnE,WAAA,MAAM,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;IAClD,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAC7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAA;IAC5D,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAChD,YAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,YAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,YAAA,MAAM,CAAC,kBAAkB,CAAC,oDAAoD,CAAC,CAAA;IAC/E,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IACzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,YAAA,MAAM,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAA;IACtC,YAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,YAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAC3D,YAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAC3D,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IACtD,YAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IACrD,YAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IACrD,YAAA,MAAM,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAAA;IACxD,YAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,YAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IACrD,YAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;IAC1D,YAAA,MAAM,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAAA;IACxD,YAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,YAAA,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAA;IAC/C,YAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,YAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAChD,YAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,YAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAK5C,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,YAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;IAC7C,YAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IAIrD,YAAA,MAAM,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAAA;IAWxD,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAKtD,YAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;IAKvD,YAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;IAMlE,YAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;IAK3E,YAAA,MAAM,CAAC,uCAAuC,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;IAK3D,YAAA,MAAM,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAA;IAAE,YAAA,QAAQ,EAAE,CAAA;qCAjFN,aAAa;QACO,uBAAuB;QACkB,wCAAwC;QAClE,+BAA+B;QACjB,yCAAyC;QAC1D,qCAAqC;QACtB,wCAAwC;QACjE,wBAAwB;QAC3B,0BAA0B;QAC1B,mBAAmB;QACR,4BAA4B;QACzB,sCAAsC;QACT,qCAAqC;QACzC,2DAA2D;QACrG,cAAc;QAClB,YAAY;QACd,kBAAkB;QACoB,qCAAqC;QACjC,uCAAuC;QACvC,uCAAuC;QACjD,yCAAyC;QAC3C,wCAAwC,sBAGxD,gCAAgC;QAChB,0BAA0B;QAChB,6CAA6C;QACxD,oCAAoC;QACnD,yBAAyB;QACrB,2BAA2B;QACnB,sCAAsC;QACrC,mCAAmC;QACzC,gCAAgC;QACzC,+BAA+B;QAK1B,8BAA8B;QAC1B,gCAAgC,sBAgBpB,2BAA2B,YAWnF,yCAAyC,sBAemC,yCAAyC;GA9FjK,8BAA8B,CA+tG1C;;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAI,MAAyC;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,OAAO,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["import 'reflect-metadata';\nimport { assignDerivableOrganizationTypesAtBoot } from '~wildo-backend-lib/organizations/services/organization-type-boot-assignment.backend.utils';\nimport { injectable, inject, optional } from 'inversify';\nimport type { PersistenceAdapterType, ResourceConfiguration_InitializationFactoryMap, ResourceRelationship, ResourcesRegistry, ResourceType, RolesConfiguration, FlowsActors_Agent, ResourceConfiguration, FeatureDefinitionWithAutoRegister, FeatureConfiguration, ScopeFeatures, MilestoneDefinition, ForeignKeyFillabilityViolation, CompositionSeedabilityViolation, CompositionSeedabilityResourceInput, CompositionCascadeDeletabilityViolation, NotificationBadgeDefinition, ResourceServerInstance } from '@wildo-ai/saas-models';\nimport type { DataSeedDefinition } from '~wildo-backend-lib/data-seeding/models/data-seed.shared.schemas';\nimport type { DataSeedScopeResolver } from '~wildo-backend-lib/data-seeding/services/data-seed-scope-resolver-registry.backend.service';\nimport type { DataSeedScopeResolverRegistryBackendService } from '~wildo-backend-lib/data-seeding/services/data-seed-scope-resolver-registry.backend.service';\nimport { runDataSeedingApplicationLifecyclePasses, wireDataSeedingDeclarations } from '~wildo-backend-lib/data-seeding/services/data-seed-application-bootstrap.backend';\nimport { admitDataSeedsForApplicationEnvironment } from '~wildo-backend-lib/data-seeding/services/data-seed-environment-admission.backend';\nimport { readDeclaredApplicationEnvironment } from '~wildo-backend-lib/config/models/app-env-config.backend.schemas';\nimport type { FlowActorSystem_InitializationFactoryMap } from '~wildo-backend-lib/flows-actors/models/flows-actors.backend.schemas';\nimport type { FunctionTool } from '~wildo-backend-lib/flows-actors/models/function-tools.backend.definitions';\nimport type { FlowsActors_AutonomousAgentDeclaration } from '~wildo-backend-lib/flows-actors/models/autonomous-agents.backend.definitions';\nimport type { BackendProviderRegistry } from '@wildo-ai/external-connectors-private/backend';\nimport {\n createSystemOfRecordFacetResolver,\n createSystemOfRecordVendorAliasResolver,\n} from '~wildo-backend-lib/systems-of-record/system-of-record-facet-loader.backend';\nimport type { SystemsOfRecordRegistryBackendService } from '~wildo-backend-lib/systems-of-record/systems-of-record-registry.backend.service';\nimport { SYSTEMS_OF_RECORD_REGISTRY_SERVICE_TYPE } from '~wildo-backend-lib/systems-of-record/systems-of-record-registry.service-type.backend';\nimport { AdministrativeContinuityBreachDetection, ErrorType, ErrorCustomMessageReference, FeatureUnavailabilityBehavior, FeatureUnavailabilityReason, BILLING_SCOPES, ActivationCriterionType, ResourcePrimaryScope, CoreResourceType, CoreResourceOperation, CORE_APP_ROLES, CORE_ORG_ROLES, collectServiceProviderDeclarationViolations,\n collectDelegatedCapabilityRoleViolations, serviceProviderExpertApprovalDeadlinesIssues, RelationshipNature, validateRequiredForeignKeyFillability, ForeignKeyFillabilityViolationSeverity, validateCompositionSeedability, validateCompositionCascadeDeletability, collectUnclassifiedDependentLifecycleEdges, ChildLifecycleStrategy, EngineCapability, SystemOfRecordErrorCode, InboundSourceKind, FlowActorSystem_Visibility } from '@wildo-ai/saas-models';\nimport type { LifecycleConfig, OrganizationUnitNarrowingDeclaration, ReviewDeadlinesDeclaration, ServiceProviderOrganizationWideAccessDeclaration } from '@wildo-ai/saas-models';\nimport { collectApplicationResourcesWithNoPersonalDataDeclaration, type PersonalDataDeclarationSubject } from '@wildo-ai/saas-models';\nimport { validateInitiatorStampedFieldSatisfiability, type InitiatorStampedFieldViolation } from '@wildo-ai/saas-models';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ApplicationIdentityBackendService } from '~wildo-backend-lib/applications/services/application-identity.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { SYSTEM_AUDIT_PRINCIPAL } from '~wildo-backend-lib/compliance/audit-trails/utils/audit-actor.backend.utils';\nimport {\n ADMINISTRATIVELY_USABLE_USER_STATUSES,\n measureUsableSuperAdminPopulation,\n resolveSuperAdminConferringRoles,\n SUPER_ADMIN_FLOOR_MINIMUM,\n} from '~wildo-backend-lib/security/authorizations/super-admin-floor.backend.utils';\nimport {\n ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES,\n ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES,\n measureOrganizationsMissingUsableOwner,\n ORGANIZATION_OWNER_FLOOR_MINIMUM,\n resolveOrganizationOwnerConferringRoles,\n} from '~wildo-backend-lib/security/authorizations/organization-owner-floor.backend.utils';\nimport { enumeratePrivilegedAccessPopulation } from '~wildo-backend-lib/security/authorizations/privileged-access-review.backend.utils';\nimport { ApplicationRuntimeProfile, resolveApplicationRuntimeProfileBootAssertions } from '~wildo-backend-lib/config/bootstrap/application-runtime-profile.backend';\nimport {\n ApplicationOwnerOrganizationAbsence,\n type ApplicationOwnerOrganizationResolverBackendService,\n} from '~wildo-backend-lib/organizations/services/application-owner-organization-resolver.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { mongoDbIsSelectedStore } from '~wildo-backend-lib/databases/utils/mongodb-runtime-dependency.backend.utils';\nimport { describeAbuseThrottleRelaxation } from '~wildo-backend-lib/errors/utils/rate-limit-environment-relaxation.backend.utils';\nimport { ApplicationStartupConfigValidatorService } from '~wildo-backend-lib/config/services/application-startup-config-validator.backend.service';\nimport { ObservabilityBackendService } from '~wildo-backend-lib/monitoring/observability/services/observability.backend.service';\nimport type { AppConfiguration } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport type { AppConfiguration_BackendAuthored } from '~wildo-backend-lib/config/models/app-config.backend-authored.definitions';\nimport type { ProviderRuntimeArtifact } from '~wildo-backend-lib/config/models/provider-runtime-artifact.backend.schemas';\nimport { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { SubjectSessionRevocationBackendService } from '~wildo-backend-lib/compliance/privacy/services/subject-session-revocation.backend.service';\nimport type { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { BackendProviderRegistryBackendService } from '~wildo-backend-lib/external-providers/services/backend-provider-registry.backend.service';\nimport { resolveBackendProviderRegistry } from '~wildo-backend-lib/external-providers/services/backend-provider-loader.backend.service';\nimport { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { FeatureDefinitionRegistryBackendService } from '~wildo-backend-lib/features/services/feature-definition-registry.backend.service';\nimport { MilestoneDefinitionRegistryBackendService } from '~wildo-backend-lib/guidance/services/milestone-definition-registry.backend.service';\nimport { MilestoneConditionRegistryBackendService } from '~wildo-backend-lib/guidance/services/milestone-condition-registry.backend.service';\nimport type { MilestoneConditionFn } from '~wildo-backend-lib/guidance/services/milestone-condition-registry.backend.service';\nimport type { ValueMomentAchievementHandler } from '~wildo-backend-lib/monitoring/analytics/services/value-moment-handler-registry.backend.service';\nimport type { ValueMomentHandlerRegistryBackendService } from '~wildo-backend-lib/monitoring/analytics/services/value-moment-handler-registry.backend.service';\nimport type { ValueMomentDefinitionRegistryBackendService } from '~wildo-backend-lib/monitoring/analytics/services/value-moment-definition-registry.backend.service';\nimport { LifecycleEvaluatorBackendService } from '~wildo-backend-lib/guidance/services/lifecycle-evaluator.backend.service';\nimport { initializeLifecycleCustomImplementations } from '~wildo-backend-lib/guidance/services/lifecycle-custom-implementations.backend';\nimport { createDormancyDetectionBatch } from '~wildo-backend-lib/guidance/batches/dormancy-detection.batch.backend.service';\nimport { createDataSeedingScheduledRerunBatch } from '~wildo-backend-lib/data-seeding/batches/data-seeding-scheduled-rerun.batch.backend.service';\nimport { createExternalDataPipelineScheduledRunBatch } from '~wildo-backend-lib/external-data/batches/external-data-pipeline-scheduled-run.batch.backend.service';\nimport { createDataSeedingRunCleanupBatch } from '~wildo-backend-lib/data-seeding/batches/data-seeding-run-cleanup.batch.backend.service';\nimport { FlowsActorsRegistryService } from '~wildo-backend-lib/flows-actors/services/flows-actors-registry.service';\nimport { ResourceServerInstancesRegistryBackendService } from '~wildo-backend-lib/mcp/services/resource-server-instances-registry.backend.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { ControllersRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/controllers-registry-handler.backend.service';\nimport { AbstractControllerBackendService } from '~wildo-backend-lib/base-classes/services/controllers/abstract-controller.backend.service';\nimport { getManualControllersBackend } from '~wildo-backend-lib/base-classes/models/manual-controllers.backend.definition';\nimport { HttpServerBackendService } from './http-server.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorHandlerService } from '~wildo-backend-lib/errors/services/error-handler.backend.service';\nimport { AuthorizationsBackendService } from '~wildo-backend-lib/security/authorizations/services/authorizations.backend.service';\nimport { BatchesCronjobsExecutor_BackendService } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-executor.backend.service';\nimport { BatchesCronjobsCustomExecution_Service } from '~wildo-backend-lib/base-classes/services/batches/batches-cronjobs-custom-execution.service';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport { ResourceOperationCustomImplementationRegistryBackendService } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-registry.backend.service';\nimport { CoreBackend_ServiceImplementationsFactories } from '~wildo-backend-lib/resources/models/custom-service-implementations.backend.definition';\nimport { createFilesCleanupBatch } from '~wildo-backend-lib/files/batches/files-cleanup.batch.backend.service';\nimport { createConsumableTokensCleanupBatch } from '~wildo-backend-lib/security/consumable-tokens/batches/consumable-tokens-cleanup.batch.backend.service';\nimport { createOrganizationOnboardingOperationsCleanupBatch } from '~wildo-backend-lib/organizations/batches/organization-onboarding-operations-cleanup.batch.backend.service';\nimport { createSystemOfRecordWriteAdmissionsCleanupBatch } from '~wildo-backend-lib/systems-of-record/system-of-record-write-admissions-cleanup.batch.backend.service';\nimport { createA2AAbandonedTaskSweepBatch } from '~wildo-backend-lib/flows-actors/a2a/batches/a2a-abandoned-task-sweep.batch.backend.service';\nimport { createApprovalPauseExpirySweepBatch } from '~wildo-backend-lib/flows-actors/batches/approval-pause-expiry-sweep.batch.backend.service';\nimport { createDecisionDeadlineSweepBatch } from '~wildo-backend-lib/flows-actors/batches/decision-deadline-sweep.batch.backend.service';\nimport { createInterruptedTurnSweepBatch } from '~wildo-backend-lib/flows-actors/batches/interrupted-turn-sweep.batch.backend.service';\nimport { autonomousAgentScheduleBatchRef, createAutonomousAgentScheduleBatch } from '~wildo-backend-lib/flows-actors/batches/autonomous-agent-schedule.batch.backend.service';\nimport { createAnonymousSessionCleanupBatch } from '~wildo-backend-lib/security/authentications/batches/anonymous-session-cleanup.batch.backend.service';\nimport { createChildLifecycleTeardownBatch } from '~wildo-backend-lib/base-classes/services/batches/child-lifecycle-teardown.batch.backend.service';\nimport { createOrganizationMemberInvitationSweepBatch } from '~wildo-backend-lib/organizations/batches/organization-member-invitation-sweep.batch.backend.service';\nimport { createCredentialExpirySweepBatch } from '~wildo-backend-lib/base-classes/services/batches/credential-expiry-sweep.batch.backend.service';\nimport { createUsageFlushBatch } from '~wildo-backend-lib/billing/batches/usage-flush.batch.backend.service';\nimport { createBillingReconciliationBatch } from '~wildo-backend-lib/billing/batches/billing-reconciliation.batch.backend.service';\nimport { createBillingEffectOutboxRelayBatch } from '~wildo-backend-lib/billing/batches/billing-effect-outbox-relay.batch.backend.service';\nimport { createBillingSubscriptionMutationRecoveryBatch } from '~wildo-backend-lib/billing/batches/billing-subscription-mutation-recovery.batch.backend.service';\nimport type { BillingSubscriptionMutationRecoveryBackendService } from '~wildo-backend-lib/billing/services/billing-subscription-mutation-recovery.backend.service';\nimport { createSuspensionReactivationSweepBatch } from '~wildo-backend-lib/base-classes/services/batches/suspension-reactivation-sweep.batch.backend.service';\nimport { createResourceRetentionSweepBatch } from '~wildo-backend-lib/base-classes/services/batches/resource-retention-sweep.batch.backend.service';\nimport { createRetentionClassSweepBatch, reportRetentionClassPositionsAtStartup } from '~wildo-backend-lib/base-classes/services/batches/retention-class-sweep.batch.backend.service';\nimport { createOrganizationPurgeBatch } from '~wildo-backend-lib/organizations/batches/organization-purge.batch.backend.service';\nimport { createModelCostPeriodCloseBatch } from '~wildo-backend-lib/flows-actors/batches/model-cost-period-close.batch.backend.service';\nimport { isScimProvisioningEnabledForAnyOrgType } from '~wildo-backend-lib/organizations/services/scim-provisioning-gate.backend.utils';\nimport { emailBatchSendService } from '~wildo-backend-lib/notifications/email/services/email-batch-send.batch.backend.service';\nimport { m2mWebhookDeliveryBatchService } from '~wildo-backend-lib/notifications/webhooks/outbound/batches/m2m-webhook-delivery.batch.backend.service';\nimport { inboundDeliveryDispatchBatchService, inboundDeliverySweepBatchService } from '~wildo-backend-lib/inbound/batches/inbound-delivery.batch.backend.service';\nimport { InboundHandlerDeclarationError, type InboundHandlerRegistryBackendService } from '~wildo-backend-lib/inbound/services/inbound-handler-registry.backend.service';\nimport type { InboundDeliveryReceiverBackendService } from '~wildo-backend-lib/inbound/services/inbound-delivery-receiver.backend.service';\nimport type { AnyInboundHandlerDefinition } from '~wildo-backend-lib/inbound/models/inbound-handler.backend.definitions';\nimport { isInboundChannelHandler, type AnyDeclaredInboundHandler } from '~wildo-backend-lib/inbound/models/inbound-channel-handler.backend.definitions';\nimport type { InboundChannelHandlerRegistryBackendService } from '~wildo-backend-lib/inbound/services/inbound-channel-handler-registry.backend.service';\nimport type { InboundChannelRuntimeBackendService } from '~wildo-backend-lib/inbound/services/inbound-channel-runtime.backend.service';\nimport { emailDomainRecheckBatchService, inboundReplySendBatchService, inboundReplySweepBatchService } from '~wildo-backend-lib/inbound/batches/inbound-reply.batch.backend.service';\nimport { createInboundEmailNotificationHandler } from '~wildo-backend-lib/inbound/email/inbound-email-notification-handler.backend';\nimport type { InboundEmailProviderBackendService } from '~wildo-backend-lib/inbound/email/inbound-email-provider.backend.service';\nimport type { InboundEmailReceptionBackendService } from '~wildo-backend-lib/inbound/email/inbound-email-reception.backend.service';\nimport { readDeclaredOutboundAdmissionEnvironment } from '~wildo-backend-lib/security/ssrf/outbound-target-admission.backend.utils';\nimport { assertNoProviderBaseUrlOverrideOutsideDevelopment } from '~wildo-backend-lib/external-providers/services/provider-base-url-override.backend.utils';\nimport { a2aPushDeliveryBatchService } from '~wildo-backend-lib/flows-actors/a2a/batches/a2a-push-delivery.batch.backend.service';\nimport { siemWebhookDeliveryBatchService } from '~wildo-backend-lib/compliance/audit-trails/batches/siem-webhook-delivery.batch.backend.service';\nimport { siemDeliveryFlushBatchService } from '~wildo-backend-lib/compliance/audit-trails/batches/siem-delivery-flush.batch.backend.service';\nimport { immudbAuditReconcileBatchService } from '~wildo-backend-lib/compliance/audit-trails/batches/immudb-audit-reconcile.batch.backend.service';\nimport { auditLogsArchiveBatchService } from '~wildo-backend-lib/compliance/audit-trails/batches/audit-logs-archive.batch.backend.service';\nimport { LAYER2_AUDIT_FAN_OUT_ACTIVE_MESSAGE, shouldRecordLayer2AuditFanOutActive, shouldWarnLayer2AuditProviderInactive } from '~wildo-backend-lib/compliance/audit-trails/utils/layer2-audit-provider-boot-diagnostic.backend.utils';\nimport { listSupportedBillingSdkPackages, resolveBillingAdapterFactory } from '~wildo-backend-lib/billing/services/billing-adapter-registry.backend';\nimport { recordBillingProviderCalls } from '~wildo-backend-lib/billing/services/billing-provider-call-recording.backend';\nimport type { ProviderCapabilityCallRecorderBackendService } from '~wildo-backend-lib/external-providers/capability-calls/provider-capability-call-recorder.backend';\n// Internal callers go through the path alias (the `@wildo-ai/saas-backend-lib/custom-batch-manifests`\n// subpath export exists for external spec-layer consumers; self-imports through the public\n// package name are not wired in this workspace's tsconfig path map).\nimport {\n ANONYMOUS_SESSION_CLEANUP_BATCH_REF,\n APPROVAL_PAUSE_EXPIRY_SWEEP_BATCH_REF,\n DECISION_DEADLINE_SWEEP_BATCH_REF,\n INTERRUPTED_TURN_SWEEP_BATCH_REF,\n ORGANIZATION_MEMBER_INVITATION_SWEEP_BATCH_REF,\n CREDENTIAL_EXPIRY_SWEEP_BATCH_REF,\n USAGE_FLUSH_BATCH_REF,\n BILLING_RECONCILIATION_BATCH_REF,\n BILLING_EFFECT_OUTBOX_RELAY_BATCH_REF,\n BILLING_SUBSCRIPTION_MUTATION_RECOVERY_BATCH_REF,\n SUSPENSION_REACTIVATION_SWEEP_BATCH_REF,\n JOB_EXECUTIONS_RETENTION_SWEEP_BATCH_REF,\n JOB_PAYLOAD_STORAGE_RETENTION_SWEEP_BATCH_REF,\n ENGINE_JOB_EXECUTIONS_RETENTION_SWEEP_MANIFEST,\n ENGINE_JOB_PAYLOAD_STORAGE_RETENTION_SWEEP_MANIFEST,\n RETENTION_CLASS_SWEEP_BATCH_REF,\n MODEL_COST_PERIOD_CLOSE_BATCH_REF,\n ORGANIZATION_PURGE_BATCH_REF,\n CONSUMABLE_TOKENS_CLEANUP_BATCH_REF,\n ORGANIZATION_ONBOARDING_OPERATIONS_CLEANUP_BATCH_REF,\n SYSTEM_OF_RECORD_WRITE_ADMISSIONS_CLEANUP_BATCH_REF,\n A2A_ABANDONED_TASK_SWEEP_BATCH_REF,\n DATA_SEEDING_RUN_CLEANUP_BATCH_REF,\n DATA_SEEDING_SCHEDULED_RERUN_BATCH_REF,\n DATA_SEEDING_SCHEDULED_RERUN_DEFAULT_CRON,\n EXTERNAL_DATA_PIPELINE_SCHEDULED_RUN_BATCH_REF,\n DORMANCY_DETECTION_BATCH_REF,\n CHILD_LIFECYCLE_TEARDOWN_BATCH_REF,\n EMAIL_BATCH_SEND_BATCH_REF,\n FILES_CLEANUP_BATCH_REF,\n M2M_WEBHOOK_DELIVERY_BATCH_REF,\n INBOUND_DELIVERY_DISPATCH_BATCH_REF,\n INBOUND_REPLY_SEND_BATCH_REF,\n INBOUND_REPLY_SWEEP_BATCH_REF,\n EMAIL_DOMAIN_RECHECK_BATCH_REF,\n INBOUND_DELIVERY_SWEEP_BATCH_REF,\n A2A_PUSH_DELIVERY_BATCH_REF,\n SIEM_WEBHOOK_DELIVERY_BATCH_REF,\n SIEM_DELIVERY_FLUSH_BATCH_REF,\n IMMUDB_AUDIT_RECONCILE_BATCH_REF,\n AUDIT_LOGS_ARCHIVE_BATCH_REF,\n RAG_RECONCILIATION_SWEEP_BATCH_REF,\n RAG_EMBEDDING_DRAIN_BATCH_REF,\n} from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport { createRagReconciliationSweepBatch } from '~wildo-backend-lib/rag/batches/rag-reconciliation-sweep.batch.backend.service';\nimport { createRagEmbeddingDrainBatch } from '~wildo-backend-lib/rag/batches/rag-embedding-drain.batch.backend.service';\nimport { SAAS_SERVICE_TYPES as TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport { MongoDBService } from '~wildo-backend-lib/databases/services/mongodb.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { I18nBackendService, CustomLabelsMap } from '~wildo-backend-lib/i18n/services/i18n.backend.service';\nimport { FileStorageRouterBackendService } from '~wildo-backend-lib/files/storage/file-storage-router.backend.service';\nimport { PdfTemplateBindingBackendService } from '~wildo-backend-lib/pdf-templates/services/pdf-template-binding.backend.service';\nimport type { PdfTemplateBindingsMap } from '~wildo-backend-lib/pdf-templates/models/pdf-template-binding';\nimport type { PdfCollectionTemplateDefinition } from '~wildo-backend-lib/pdf-templates/models/pdf-collection-template-definition';\nimport { PdfCollectionExportTemplateBackendService } from '~wildo-backend-lib/pdf-templates/services/pdf-collection-export-template.backend.service';\nimport { QueueWorkerInitializerBackendService } from '~wildo-backend-lib/queue/queue-worker-initializer.backend.service';\nimport { CronJobSyncBackendService } from '~wildo-backend-lib/queue/cron-job-sync.backend.service';\nimport type { ProductCatalogSyncBackendService } from '~wildo-backend-lib/billing/services/back-office/product-catalog-sync.backend.service';\nimport type { UsageMeteringBackendService } from '~wildo-backend-lib/billing/services/back-office/usage-metering.backend.service';\nimport type { BillingReconciliationBackendService } from '~wildo-backend-lib/billing/services/back-office/billing-reconciliation.backend.service';\nimport {\n createBillingSubjectErasureEffect,\n TERMINAL_SUBSCRIPTION_STATUSES,\n} from '~wildo-backend-lib/billing/services/back-office/billing-subject-erasure-effect.backend';\nimport { BILLING_SCOPE_TO_VARIANTS } from '~wildo-backend-lib/billing/services/custom-impl/billing-custom-impl-utils.backend';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { measureStoredProviderCredentialSlots } from '~wildo-backend-lib/security/connected-accounts/utils/retired-credential-slot.backend.utils';\nimport type { BillingFeatureSyncBackendService } from '~wildo-backend-lib/billing/services/back-office/billing-feature-sync.backend.service';\nimport { initializeBillingCustomImplementations, registerBillingPostOperationHooks, setBillingWebSocketService, setReferralProgramService, setUsageMeteringService } from '~wildo-backend-lib/billing/services/custom-impl/billing-custom-implementations.backend';\nimport type { ReferralProgramBackendService } from '~wildo-backend-lib/billing/services/referrals/referral-program.backend.service';\nimport { registerOrganizationProviderCredentialCascadeEvidence } from '~wildo-backend-lib/security/connected-accounts/services/organization-provider-credentials.custom-impl.backend.service';\nimport { registerUserProviderCredentialCascadeEvidence } from '~wildo-backend-lib/security/connected-accounts/services/user-provider-credentials.custom-impl.backend.service';\nimport { ExternalProvider_ExchangeProtocol_Kind, type Hook_Endpoint, type StandardBilling_Interface, ProviderProtocolRuntimeKind } from '@wildo-ai/external-connectors-models';\nimport type { WebhookHandlerBackendService } from '~wildo-backend-lib/notifications/webhooks/services/webhook-handler.backend.service';\nimport type { WebhookAutoControllerBackendService } from '~wildo-backend-lib/notifications/webhooks/controllers/webhook-auto-controller.backend.service';\nimport { BillingWebhookAdapter } from '~wildo-backend-lib/billing/services/webhooks/billing-webhook-adapter.backend.service';\nimport { BILLING_WEBHOOK_ENDPOINT_KEY, createBillingInboundHandler } from '~wildo-backend-lib/billing/services/webhooks/billing-inbound-handler.backend';\nimport { BillingWebhookEventRouterBackendService } from '~wildo-backend-lib/billing/services/webhooks/billing-webhook-event-router.backend.service';\nimport { BillingSubscriptionProviderProjection } from '~wildo-backend-lib/billing/services/billing-subscription-provider-projection.backend';\nimport { resolveBillingMutationApplicationId } from '~wildo-backend-lib/billing/services/billing-subscription-mutation-store.backend';\nimport type { ResourcePersistenceUnitOfWorkBackendService } from '~wildo-backend-lib/databases/services/resource-persistence-unit-of-work.backend.service';\nimport type { WebSocketService } from '~wildo-backend-lib/requests/service/websocket.service';\nimport type { BillingConfiguration, ProductDefinition, ChartDefinition, GuidanceFlowDefinition } from '@wildo-ai/saas-models';\nimport { ChartRegistryBackendService } from '~wildo-backend-lib/charts/services/chart-registry.backend.service';\nimport { GuidanceTriggerEvaluatorBackendService } from '~wildo-backend-lib/guidance/services/guidance-trigger-evaluator.backend.service';\nimport { DataSeedRegistryBackendService } from '~wildo-backend-lib/data-seeding/services/data-seed-registry.backend.service';\nimport { DataSeedDispatcherBackendService } from '~wildo-backend-lib/data-seeding/services/data-seed-dispatcher.backend.service';\nimport { DataSeedingAdminBackendController } from '~wildo-backend-lib/data-seeding/controllers/data-seeding-admin.backend.controller';\nimport { ExternalDataAdminBackendController } from '~wildo-backend-lib/external-data/controllers/external-data-admin.backend.controller';\nimport { EmailTemplateRegistryBackendService } from '~wildo-backend-lib/notifications/email/services/email-template-registry.backend.service';\nimport type { EmailTemplateDefinitionsMap } from '~wildo-backend-lib/notifications/email/models/email-template-definition';\nimport { BillingStateBackendService } from '~wildo-backend-lib/billing/services/back-office/billing-state.backend.service';\nimport { resolveFeatureGatedCoreResourceExclusions } from '~wildo-backend-lib/runtime/utils/feature-gated-core-resource-exclusions.backend.utils';\nimport { resolveApplicationConfigForStartup } from '~wildo-backend-lib/runtime/utils/application-startup-config-access.backend.utils';\n\n\n\n/**\n * Configuration object for {@link StartApplicationBackendService.initialize}.\n *\n * Groups the 25+ positional parameters into a single typed config,\n * preventing silent mis-ordering bugs (e.g. `customLabels` passed as `undefined`\n * at the wrong positional slot).\n */\nexport interface ApplicationInitializationConfig {\n sharedResourceConfigurations: ResourceConfiguration_InitializationFactoryMap;\n sharedResourceFieldIdentifiers?: Record<string, string>;\n sharedResourceRelationships: ResourceRelationship[];\n\n backendResourceConfigurations?: ResourceConfiguration_InitializationFactoryMap;\n backendResourceFieldIdentifiers?: Record<string, string>;\n backendResourceRelationships?: ResourceRelationship[];\n\n /**\n * App-declared notification badge definitions (merged with the framework's\n * `coreNotificationBadgeDefinitions` in the registry). DERIVED_QUERY badges\n * are recomputed by the dispatcher on source-resource mutations + on connect.\n */\n notificationBadgeDefinitions?: NotificationBadgeDefinition[];\n\n /**\n * Resources this application narrows by ORGANIZATION UNIT, keyed by resource type.\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege confinement of a\n * unit-scoped principal to the records of their unit.\n *\n * Naming a resource here admits a caller whose authority for it comes ONLY from an organization\n * unit grant, and then confines every read and write to the rows of the units that grant covers.\n * ADDITIVE: a caller whose organization-wide role already satisfies the operation is not narrowed\n * at all, so opting a resource in can never shrink a result set someone could already see.\n *\n * `unitFieldName` must name a real field on that resource's schema holding the owning\n * `ORGANIZATION_UNITS` id. The authorization plane (membership, unit membership, units themselves,\n * and roles-bearing machine credentials) may never be declared here — startup fails closed if it\n * is, because a resource that ISSUES authority must not be governed by the authority it issues.\n */\n organizationUnitNarrowing?: Readonly<Partial<Record<string, OrganizationUnitNarrowingDeclaration>>>;\n\n /**\n * Resources a UNIT-scoped service-provider expert may READ across the whole client organization even\n * though they do not narrow by unit — a shared reference list, say (#1597). Each entry names its\n * rationale. Startup refuses the authorization plane and any resource that narrows by unit. Absent ⇒ a\n * unit-scoped expert reaches only resources that narrow by unit, and every other resource answers as if\n * they were not a member (fail closed).\n */\n serviceProviderOrganizationWideAccess?: Readonly<Partial<Record<string, ServiceProviderOrganizationWideAccessDeclaration>>>;\n\n customServiceImplementations: ResourceCustomServiceImplementationFactory[];\n\n\n customRoles?: RolesConfiguration;\n customControllers?: AbstractControllerBackendService[];\n container?: any;\n controllerWhiteList?: string[];\n isPlatformApplication?: boolean;\n /**\n * PLATFORM MODE ONLY (refused otherwise): the persistence adapter the platform service's OWN\n * resources are built on. Platform startups hydrate `AppConfigurationService` AFTER\n * `super.initialize()`, so the normal config-driven adapter resolution cannot see their choice\n * at repository-construction time — this passes the answer the platform already holds from its\n * Phase-1 bridged config. See `RepositoriesRegistryHandlerBackendService.platformModeDefaultAdapter`\n * for the full ordering rationale (Phase 5.2, D7). Non-platform applications declare their\n * adapter in application config (`DATABASE_DEFAULT_ADAPTER`); a second knob here would smuggle\n * the decision past that contract, which is why passing it without `isPlatformApplication`\n * throws.\n */\n platformPersistenceAdapter?: PersistenceAdapterType;\n\n customBatchesFactory?: (deps: {\n logger: LoggerService;\n errorBuilder: ErrorBuilderBackendService;\n errorHandler: ErrorHandlerService;\n executionContextCreatorService: ExecutionContextCreatorBackendService;\n resourcesRegistryService: ResourcesRegistryBackendService;\n repositoriesRegistryService: RepositoriesRegistryHandlerBackendService;\n servicesRegistryService: ServicesRegistryHandlerBackendService;\n }) => Map<string, BatchesCronjobsCustomExecution_Service<any, any>>;\n\n flowsActorsRegistry?: {\n flowActorSystemsFactoryMap?: FlowActorSystem_InitializationFactoryMap;\n agents?: FlowsActors_Agent[];\n functionTools?: FunctionTool[];\n /** Agents that may run unattended once a tenant binds a client to them (#1611). */\n autonomousAgents?: FlowsActors_AutonomousAgentDeclaration[];\n };\n\n /**\n * App-declared NAMED external resource-server instances (R-2): multiple MCP servers and/or A2A\n * agents, each served at its own URL segment with its own RFC 8707 audience, discovery document,\n * and curated content (MCP tools via `operation.mcp.servers`; A2A skills via `actorSystemRefs`).\n *\n * Purely ADDITIVE — the unnamed default `/mcp` and `/a2a` surfaces always exist and are not\n * declared here. Membership refs are validated against the resource + actor-system registries at\n * startup, so a ref typo is a startup failure rather than a silently-empty surface.\n */\n resourceServerInstances?: ResourceServerInstance[];\n\n customLabels?: CustomLabelsMap;\n backendProviderRegistry?: BackendProviderRegistry;\n\n customFeatureDefinitions?: FeatureDefinitionWithAutoRegister[];\n customFeatureConfiguration?: {\n profiles?: Record<string, ScopeFeatures>;\n defaultProfile?: string;\n unavailabilityPolicy?: Partial<FeatureConfiguration['unavailabilityPolicy']>;\n };\n\n chartDefinitions?: ChartDefinition[];\n customMilestoneDefinitions?: MilestoneDefinition[];\n customMilestoneConditions?: Array<{ ref: string; fn: MilestoneConditionFn }>;\n /**\n * Backend handlers a value moment's `onAchieved.backendHandler` can name.\n *\n * `ValueMomentHandlerRegistryBackendService` existed, was bound, and was injected into the\n * engine — and NOTHING could call `registerHandler`, so the per-moment callback surface was\n * unreachable by construction (#414). This is that path, shaped like\n * `customMilestoneConditions` beside it because it answers the same question: a declaration\n * names a function by ref, and the application supplies the function.\n */\n valueMomentHandlers?: Array<{ ref: string; fn: ValueMomentAchievementHandler }>;\n productDefinitions?: ProductDefinition[];\n emailTemplateDefinitions?: EmailTemplateDefinitionsMap;\n /** Generated provider topology module imported by the application package. */\n providerRuntime?: ProviderRuntimeArtifact;\n /**\n * Backend-only generated PDF template bindings.\n *\n * Shared `z_file({ generation })` metadata carries only a stable\n * `templateId` because resource schemas are consumed by frontend,\n * specification, and companion surfaces. The live React-PDF template object\n * stays here, in backend startup configuration, and is validated against the\n * already-initialized resource registry before services/controllers accept\n * traffic.\n */\n pdfTemplateBindings?: PdfTemplateBindingsMap;\n /**\n * Collection-export PDF templates (#1645): each renders the rows of a LIST/SEARCH export that\n * declares `collectionExport: { formats: [PDF], pdfTemplateId }`. Checked at boot against every\n * export that names one, in both directions.\n */\n pdfCollectionExportTemplates?: readonly PdfCollectionTemplateDefinition<any, any>[];\n backendConfig?: AppConfiguration_BackendAuthored;\n guidanceFlowDefinitions?: GuidanceFlowDefinition[];\n\n /**\n * Declarative data-seed definitions collected from `BackendDomainModule.seeds`.\n *\n * Consumed by the `DataSeedRegistry` / `DataSeedDispatcher` to run\n * application-lifecycle seeds at boot (Step 7.7) and resource-lifecycle /\n * lazy seeds at request time. See `.cursor/plans/seeding-first-class.md`.\n */\n dataSeeds?: DataSeedDefinition[];\n\n /**\n * Phase 7 / Item 47 (cron scheduler) — Slice 3.\n *\n * Custom scope-iteration callbacks aggregated from each module's\n * `BackendDomainModule.dataSeedScopeResolvers`. Forwarded to\n * `wireDataSeedingDeclarations` (Step 5.9), which calls\n * `DataSeedScopeResolverRegistryBackendService.registerResolvers` once\n * per boot.\n *\n * Cron seeds with `schedule.iterationStrategy === CUSTOM_RESOLVER`\n * resolve their `relatedId` rows via the resolver registered under the\n * matching `customResolverKey`.\n */\n dataSeedScopeResolvers?: Record<string, DataSeedScopeResolver>;\n\n /**\n * Inbound handlers collected from `BackendDomainModule.inboundHandlers` (#1596). Validated and\n * registered FATALLY at Step 4.55, before the webhook auto-controller mounts any route.\n */\n inboundHandlers?: AnyDeclaredInboundHandler[];\n\n /**\n * WHICH RUNTIME is booting this lifecycle, which determines which boot\n * ASSERTIONS apply. Defaults to\n * {@link ApplicationRuntimeProfile.APPLICATION_BACKEND}, so a host that does\n * not declare a profile is over-validated rather than under-validated.\n *\n * Distinct from {@link headlessMode} and its siblings: those control which\n * subsystems START, this controls which DECLARATION CLASSES are asserted to\n * be complete. See `application-runtime-profile.backend.ts`.\n */\n runtimeProfile?: ApplicationRuntimeProfile;\n /** Skip HTTP server initialization (used by apps-manager for E2E testing) */\n headlessMode?: boolean;\n /** Skip cron-job sync for non-HTTP runtimes like minions. */\n skipCronSync?: boolean;\n /**\n * Skip the shared application job consumers for runtimes that connect to\n * RabbitMQ only for their own dedicated topology (default: `false`).\n *\n * The canonical opt-in is a `BackgroundRuntimeType.MINION`: it reuses the\n * full backend startup lifecycle but must consume ONLY its own\n * `minion-tick.<name>` queue, never the shared operations/scheduled/callbacks\n * queues. When `true`, the queue-worker initializer still connects to the\n * broker (the minion's tick consumer needs that connection) but does NOT run\n * `jobConsumer.startConsuming()` — otherwise RabbitMQ would round-robin each\n * scheduled-cron tick between the backend-api pod and the minion, and the\n * minion would dead-letter every tick it cannot interpret (~50% loss).\n *\n * Sibling of {@link skipCronSync}; both default `false` so backend-api is\n * unaffected. Never set on the primary backend-api runtime.\n */\n skipJobConsumers?: boolean;\n /**\n * Runtime-specific decorator hook for the services registry.\n *\n * Used by the minion kernel to install resource-access enforcement without\n * changing the backend-api DI graph.\n */\n servicesRegistryDecoratorFactory?: (\n registry: ServicesRegistryHandlerBackendService,\n context: {\n appConfig: AppConfiguration;\n errorBuilder: ErrorBuilderBackendService;\n },\n ) => ServicesRegistryHandlerBackendService;\n /**\n * Runtime-specific hook that runs immediately after the resource catalog is\n * initialized and before downstream registries (services, flows/actors, controllers)\n * are installed.\n *\n * Minion startup uses this to cross-validate its `resourceAccess` whitelist\n * against the live application resource catalog.\n */\n afterResourcesRegistryInitialized?: (context: {\n appConfig: AppConfiguration;\n resourcesRegistryService: ResourcesRegistryBackendService;\n errorBuilder: ErrorBuilderBackendService;\n }) => Promise<void> | void;\n\n /**\n * Caller-supplied `<scope>.<name>` identifier for THIS backend process.\n * Runtime provider selection is now expected to come from materialized\n * provider-scope artifacts. Examples:\n * - `'services.backend-api'` for a regular backend service\n * - `'minions.marketingScrapper'` for a minion process\n * - `'workers.myRustWorker'` for a worker process\n *\n * Each app's bootstrap (`index.ts`) is responsible for choosing\n * the correct value. The current runtime keeps the field so the\n * materializer can bind the process to its provider scope without\n * inferring from `SERVICE_NAME`.\n */\n serviceIdentifier?: string;\n}\n\n/**\n * Start Application Backend Service\n *\n * Orchestrates the initialization of the backend application by:\n * 1. Initializing application configuration\n * 1.5. Initializing roles configuration (defaults + custom roles)\n * 2. Initializing resources registry with all 4 sources\n * 3. Initializing repositories registry with mongoose models\n * 4. Initializing services registry with business logic layer\n * 5. Initializing controllers registry with HTTP endpoints layer\n * 6. Initializing HTTP server with Express.js and middleware\n * 7. Validating all components are properly initialized\n *\n * This service ensures proper startup sequence and dependency management.\n */\n\n/** @wildo_source:part:start saas.backend.billing.resolution-failure-reasons facet:layer:backend facet:family:billing */\n/**\n * Why billing-provider resolution failed at startup. Each reason maps 1:1 to a\n * DISTINCT config surface an app author must fix, so `billing.enabled: true`\n * that cannot resolve a provider fails LOUD with an actionable message instead\n * of the historical catch-all (\"set providerRef + its secret\") that misdirected\n * authors to the secret when the real gap was backend-scope authoring.\n *\n * Read this as a debugging map — the fatal startup message names the surface,\n * and each reason below is the surface:\n * - PROVIDER_REF_UNSET → `billing.providerRef` in `./backend-api/src/saas-config.backend.ts`\n * - PROVIDER_NOT_REACHABLE_ON_BACKEND → author the ref under `providers.scopes.backend` in `./wildo.saas.config.ts` (the classic trap: authored only in a frontend scope), then `wildo config sync`. An engine-shipped or package-shipped provider needs NO hand-authored contribution: discovery reads the provider package's own `./companion` barrel and derives the backend target from that scope\n * - PROVIDER_DISABLED → the ref resolves but is disabled for the BILLING protocol in external-provider config\n * - SECRET_MISSING → the env var named by the provider's `secretRef` is absent from the per-env `providerEnv` secrets\n * - NO_ADAPTER_FOR_SDK_PACKAGE → the engine ships no billing adapter for the `sdkPackage` the provider declares. The one reason here that is NOT a config surface — no application edit fixes it\n * - RESOLUTION_ERROR → the provider threw while resolving (registry / billing-SDK fault)\n */\nenum BillingProviderResolutionFailureReason {\n /** `billing.enabled` is true but `billing.providerRef` is unset. */\n PROVIDER_REF_UNSET = 'provider-ref-unset',\n /**\n * `providerRef` is set, but no billing runtime contract is exposed to the\n * backend registry for it — the provider is not in the generated\n * provider-runtime artifact this host loads, so it was filtered out of the\n * active catalog.\n *\n * Almost always one of two things: the ref is not authored under\n * `providers.scopes.backend` (the common trap — it is authored only in a\n * frontend scope), or the artifact has not been regenerated since it was.\n *\n * A ref that is scoped but that discovery cannot supply for this runtime is\n * NOT this reason: `validateDiscoveredSaasProviderContributions` refuses that\n * at `wildo config sync`, naming the scope, long before a boot.\n */\n PROVIDER_NOT_REACHABLE_ON_BACKEND = 'provider-not-reachable-on-backend',\n /** The provider resolves but is disabled by external-provider configuration. */\n PROVIDER_DISABLED = 'provider-disabled',\n /** The provider resolves but its secret (env var `secretRef`) is absent. */\n SECRET_MISSING = 'secret-missing',\n /**\n * The provider is reachable, enabled and holds its secret, but the engine ships no billing\n * adapter for the `sdkPackage` its runtime contract declares.\n *\n * This is a FRAMEWORK gap rather than an application misconfiguration — the only one of these\n * reasons the operator cannot fix by editing config — and it exists so that state is stated.\n * Until this reason existed, that configuration silently received Stripe's adapter built over\n * the other provider's secret, because the resolution narrowed on the protocol `kind` and then\n * constructed one named class. `detail` carries the unserved `sdkPackage`.\n */\n NO_ADAPTER_FOR_SDK_PACKAGE = 'no-adapter-for-sdk-package',\n /** An unexpected error was thrown while resolving (registry/SDK fault). */\n RESOLUTION_ERROR = 'resolution-error',\n}\n/** @wildo_source:part:end saas.backend.billing.resolution-failure-reasons */\n\n/**\n * Discriminated result of {@link StartApplicationBackendService.resolveBillingProvider}.\n * A `null` provider always carries a `reason` (and optional `detail`) so the\n * caller can build a surface-specific error instead of a generic one.\n */\n/**\n * Outcome of {@link StartApplicationBackendService.resolveBillingProvider}.\n *\n * `resolved` is an explicit literal discriminant on purpose: the earlier shape discriminated on\n * `provider: null`, which does not narrow the union in every compiler configuration, so the\n * success-only `providerRef` — the ref every billing row is stamped with (#327) — was unreachable\n * after the failure guard.\n */\ntype BillingProviderResolution =\n | { resolved: true; provider: StandardBilling_Interface; providerRef: string }\n | { resolved: false; reason: BillingProviderResolutionFailureReason; detail?: string };\n\n/**\n * Build the fatal startup message for a failed billing-provider resolution,\n * routed by {@link BillingProviderResolutionFailureReason} to the SPECIFIC\n * config surface the operator must fix. Historically this was a single\n * catch-all (\"set providerRef + its secret\"), which misdirected operators\n * whenever the real gap was backend-scope authoring (providerRef + secret\n * both present, provider simply not exposed to the backend runtime).\n *\n * Every branch names the file/field to edit and the follow-up command\n * (`wildo config sync`) so the message is actionable without reading source.\n */\nfunction describeBillingProviderResolutionFailure(\n reason: BillingProviderResolutionFailureReason,\n billingConfig: BillingConfiguration,\n detail?: string,\n): string {\n const providerRef = billingConfig.providerRef ?? '(unset)';\n const prefix = 'billing.enabled is true but the billing provider could not be resolved.';\n const disableHint = 'Alternatively set billing.enabled=false to run without billing.';\n\n switch (reason) {\n case BillingProviderResolutionFailureReason.PROVIDER_REF_UNSET:\n return `${prefix} billing.providerRef is unset — set it (e.g. 'stripe') in your `\n + `backend app config (saas-config.backend.ts → billing.providerRef). ${disableHint}`;\n\n case BillingProviderResolutionFailureReason.PROVIDER_NOT_REACHABLE_ON_BACKEND:\n return `${prefix} providerRef='${providerRef}' is set, but that provider is not exposed `\n + `to the BACKEND runtime, so no billing runtime contract could be loaded. A common `\n + `cause is authoring the provider only in a frontend scope. Fix: author '${providerRef}' `\n + `under providers.scopes.backend in wildo.saas.config.ts (providerCapabilities ['BILLING'], `\n + `protocols ['BILLING_PROVIDER', 'WEBHOOK_ORIGINATOR']), then re-run `\n + `\\`wildo config sync\\` to regenerate the provider runtime artifact. An engine-shipped `\n + `or package-shipped provider needs no hand-authored contribution — discovery reads the `\n + `provider package's own companion barrel and derives the backend target from that scope. `\n + `${disableHint}`;\n\n case BillingProviderResolutionFailureReason.PROVIDER_DISABLED:\n return `${prefix} providerRef='${providerRef}' resolves but is disabled by external-provider `\n + `configuration for the BILLING protocol. Enable it for this environment, then re-run `\n + `\\`wildo config sync\\`. ${disableHint}`;\n\n case BillingProviderResolutionFailureReason.SECRET_MISSING:\n return `${prefix} providerRef='${providerRef}' resolves but its secret `\n + `(env var '${detail ?? 'UNKNOWN'}') is missing. Populate it in your per-env secrets `\n + `(providerEnv) and re-run \\`wildo config sync\\` so it lands in the backend .env. ${disableHint}`;\n\n case BillingProviderResolutionFailureReason.NO_ADAPTER_FOR_SDK_PACKAGE:\n return `${prefix} providerRef='${providerRef}' is reachable, enabled and holds its secret, but `\n + `it declares sdkPackage='${detail ?? 'UNKNOWN'}' and this engine ships no billing adapter `\n + `for it (adapters available: ${listSupportedBillingSdkPackages().join(', ') || 'none'}). `\n + `This is a FRAMEWORK gap, not a config error: no edit to wildo.saas.config.ts can fix it. `\n + `Either point billing.providerRef at a provider whose sdkPackage is served, or add the `\n + `adapter to the engine's billing adapter registry `\n + `(billing/services/billing-adapter-registry.backend.ts). ${disableHint}`;\n\n case BillingProviderResolutionFailureReason.RESOLUTION_ERROR:\n return `${prefix} providerRef='${providerRef}' threw while resolving`\n + `${detail ? `: ${detail}` : ''}. Inspect the backend provider registry / billing SDK `\n + `wiring. ${disableHint}`;\n\n default: {\n // Exhaustiveness guard: adding a new reason without a message\n // branch fails the type-check here rather than shipping a blank\n // fatal at runtime.\n const _exhaustive: never = reason;\n return `${prefix} providerRef='${providerRef}' (${String(_exhaustive)}). ${disableHint}`;\n }\n }\n}\n\n@injectable()\nexport class StartApplicationBackendService {\n /**\n * The profile this runtime booted under. Defaults FAIL-SAFE to `APPLICATION_BACKEND` — the\n * profile that asserts and reports the most — so a host that never declares one is never\n * silently exempted from a check it should run.\n */\n private resolvedRuntimeProfile: ApplicationRuntimeProfile = ApplicationRuntimeProfile.APPLICATION_BACKEND;\n\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n protected isInitialized = false;\n private isPlatformMode = false;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) protected readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) protected readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ApplicationStartupConfigValidatorService) protected readonly applicationStartupConfigValidator: ApplicationStartupConfigValidatorService,\n @inject(SAAS_SERVICE_TYPES.ResourceRegistryService) protected readonly resourcesRegistryService: ResourcesRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) protected readonly repositoriesRegistryService: RepositoriesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) protected servicesRegistryService: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.ControllersRegistryHandlerService) protected readonly controllersRegistryService: ControllersRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.HttpServerService) protected readonly httpServerService: HttpServerBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) protected readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorHandlerService) protected readonly errorHandler: ErrorHandlerService,\n @inject(SAAS_SERVICE_TYPES.AuthorizationsService) protected readonly authorizationsService: AuthorizationsBackendService,\n @inject(SAAS_SERVICE_TYPES.BatchesCronjobsExecutorService) protected readonly batchesExecutor: BatchesCronjobsExecutor_BackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) protected readonly executionContextCreatorBackendService: ExecutionContextCreatorBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourceOperationCustomImplementationRegistryService) protected readonly customImplRegistry: ResourceOperationCustomImplementationRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.MongoDBService) protected readonly mongoDBService: MongoDBService,\n @inject(SAAS_SERVICE_TYPES.RedisService) protected readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.I18nService) protected readonly i18nService: I18nBackendService,\n @inject(SAAS_SERVICE_TYPES.BackendProviderRegistryService) protected readonly backendProviderRegistryService: BackendProviderRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) protected readonly externalProvidersRegistryService: ExternalProvidersRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.FeatureDefinitionRegistryService) protected readonly featureDefinitionRegistryService: FeatureDefinitionRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.MilestoneDefinitionRegistry) protected readonly milestoneDefinitionRegistry: MilestoneDefinitionRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.MilestoneConditionRegistry) protected readonly milestoneConditionRegistry: MilestoneConditionRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ValueMomentHandlerRegistry) protected readonly valueMomentHandlerRegistry: ValueMomentHandlerRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.ValueMomentDefinitionRegistry) protected readonly valueMomentDefinitionRegistry: ValueMomentDefinitionRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.LifecycleEvaluator) protected readonly lifecycleEvaluator: LifecycleEvaluatorBackendService,\n @inject(SAAS_SERVICE_TYPES.FlowsActorsRegistryService) protected readonly flowsActorsRegistryService: FlowsActorsRegistryService,\n @inject(SAAS_SERVICE_TYPES.ResourceServerInstancesRegistry) protected readonly resourceServerInstancesRegistry: ResourceServerInstancesRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.QueueWorkerInitializerService) protected readonly queueWorkerInitializer: QueueWorkerInitializerBackendService,\n @inject(SAAS_SERVICE_TYPES.CronJobSyncService) protected readonly cronJobSyncService: CronJobSyncBackendService,\n @inject(SAAS_SERVICE_TYPES.ChartRegistryService) protected readonly chartRegistryService: ChartRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.GuidanceTriggerEvaluator) protected readonly guidanceTriggerEvaluator: GuidanceTriggerEvaluatorBackendService,\n @inject(SAAS_SERVICE_TYPES.EmailTemplateRegistry) protected readonly emailTemplateRegistryService: EmailTemplateRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.PdfTemplateBinding) protected readonly pdfTemplateBindingService: PdfTemplateBindingBackendService,\n @inject(SAAS_SERVICE_TYPES.FileStorageRouter) protected readonly fileStorageRouter: FileStorageRouterBackendService,\n // Phase 2.F — data-seeding subsystem. Registry stays inert until\n // Step 5.9 calls `registerSeeds(config.dataSeeds ?? [])` and wires the\n // Level-B hooks / lazy-access guards; the dispatcher runs the\n // application-lifecycle passes at Step 7.7 (and from those hooks later).\n @inject(SAAS_SERVICE_TYPES.DataSeedRegistry) protected readonly dataSeedRegistryService: DataSeedRegistryBackendService,\n @inject(SAAS_SERVICE_TYPES.DataSeedDispatcher) protected readonly dataSeedDispatcherService: DataSeedDispatcherBackendService,\n @inject(SAAS_SERVICE_TYPES.ApplicationIdentityService) protected readonly applicationIdentityService: ApplicationIdentityBackendService,\n // Phase 7 / Item 47 (Slice 3) — cron CUSTOM_RESOLVER registry. Same\n // boot lifecycle as `dataSeedRegistryService`: hydrated once in Step\n // 7.7 from `ApplicationInitializationConfig.dataSeedScopeResolvers`.\n @inject(SAAS_SERVICE_TYPES.DataSeedScopeResolverRegistry) protected readonly dataSeedScopeResolverRegistryService: DataSeedScopeResolverRegistryBackendService,\n // Slice 2 Phase 4 — observability reconcile + graceful-flush wiring. Appended LAST on\n // PURPOSE: `StartApplicationBackendService` has platform subclasses with FORWARDING\n // constructors that spread a positional `super([...])` array (see\n // `start-application.apps-manager.platform.service.ts` and `...registry.platform.service.ts`).\n // Inserting a param mid-list shifts every later arg and mis-injects them — it crashed the\n // apps-manager with \"featureDefinitionRegistryService.registerCoreFeatures is not a function\".\n // Appending keeps those subclasses aligned (they don't forward this last arg → it is\n // `undefined` there, which is HARMLESS because the reconcile call is gated on\n // `!isPlatformApplication`). Wonder-todos uses this class directly, so Inversify injects it\n // by symbol regardless of position. Optional type + `?.` call site reflect the platform case.\n @inject(SAAS_SERVICE_TYPES.ObservabilityBackendService) protected readonly observabilityBackendService?: ObservabilityBackendService,\n // APPENDED for the same subclass-forwarding reason as `observabilityBackendService` above:\n // subclasses that do not forward this arg receive `undefined`, which is harmless here — the\n // super-administrator floor REPORT degrades to a log-only finding when no audit sink is\n // bound, and the report is non-fatal by design either way.\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) @optional() protected readonly auditLogsService?: AuditLogsBackendService,\n // Appended LAST (platform-subclass forwarding, as above). The organization-owner floor REPORT\n // builds its own whole-estate measuring context from this factory; a platform subclass that does\n // not forward it receives `undefined`, which is harmless — `reportOrganizationOwnerFloor` skips\n // when it is absent, and platform mode runs no tenant population anyway.\n @inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory) @optional()\n protected readonly authExecutionContextFactory?: AuthExecutionContextFactoryBackendService,\n // Appended LAST again, for the same subclass-forwarding reason (#1054). A subclass that does\n // not forward it receives `undefined`, which is harmless: `reportApplicationOwnerOrganization`\n // skips when it is absent, and platform mode — the only caller that subclasses this — declares\n // no owner organization type at all.\n @inject(SAAS_SERVICE_TYPES.ApplicationOwnerOrganizationResolver) @optional()\n protected readonly applicationOwnerOrganizationResolver?: ApplicationOwnerOrganizationResolverBackendService,\n // Appended LAST once more, same reason (#1055). A platform subclass that does not forward it\n // receives `undefined`, which is harmless: the initialisation below skips, and no platform\n // service declares a system of record.\n @inject(SYSTEMS_OF_RECORD_REGISTRY_SERVICE_TYPE) @optional()\n private readonly systemsOfRecordRegistry?: SystemsOfRecordRegistryBackendService,\n // APPENDED LAST, optional (#1645), for the platform-subclass forwarding reason above: a subclass that\n // does not forward it receives `undefined`, which is harmless — no platform service declares a PDF\n // collection export, so there is nothing to initialize there.\n @inject(SAAS_SERVICE_TYPES.PdfCollectionExportTemplates) @optional() protected readonly pdfCollectionExportTemplateService?: PdfCollectionExportTemplateBackendService,\n ) {\n this.logger = logger;\n this.appConfigService = appConfigService;\n this.resourcesRegistryService = resourcesRegistryService;\n this.repositoriesRegistryService = repositoriesRegistryService;\n this.servicesRegistryService = servicesRegistryService;\n this.controllersRegistryService = controllersRegistryService;\n this.httpServerService = httpServerService;\n this.authorizationsService = authorizationsService;\n\n this.logDebug = this.logger.debugByType('StartApplicationBackendService');\n this.logger.setDebugTypeLogging('StartApplicationBackendService', false);\n\n this.logDebug('Start application service created');\n }\n\n /**\n * Initialize the backend application with a structured configuration object.\n */\n public async initialize(config: ApplicationInitializationConfig): Promise<void> {\n\n if (this.isInitialized) {\n this.logDebug('Application already initialized, skipping');\n return;\n }\n\n const {\n sharedResourceConfigurations,\n sharedResourceFieldIdentifiers,\n sharedResourceRelationships,\n backendResourceConfigurations,\n backendResourceFieldIdentifiers,\n backendResourceRelationships = [],\n notificationBadgeDefinitions,\n organizationUnitNarrowing,\n serviceProviderOrganizationWideAccess,\n resourceServerInstances,\n customServiceImplementations,\n customRoles,\n customControllers,\n container,\n controllerWhiteList,\n isPlatformApplication = false,\n platformPersistenceAdapter,\n customBatchesFactory,\n flowsActorsRegistry,\n customLabels,\n backendProviderRegistry,\n customFeatureDefinitions,\n customFeatureConfiguration,\n chartDefinitions,\n customMilestoneDefinitions,\n valueMomentHandlers,\n customMilestoneConditions,\n productDefinitions,\n emailTemplateDefinitions,\n providerRuntime,\n pdfTemplateBindings,\n pdfCollectionExportTemplates,\n backendConfig,\n guidanceFlowDefinitions,\n dataSeeds: declaredDataSeeds,\n dataSeedScopeResolvers,\n inboundHandlers = [],\n runtimeProfile = ApplicationRuntimeProfile.APPLICATION_BACKEND,\n headlessMode = false,\n skipCronSync = false,\n skipJobConsumers = false,\n servicesRegistryDecoratorFactory,\n afterResourcesRegistryInitialized,\n } = config;\n\n /*\n * The seeds THIS deployment runs (#2234): a seed restricted to other runtime environments — demonstration\n * data kept out of production — is withheld here, once, so registration and both seeding gates below read\n * the same set. Withheld when the environment is undeclared: an unknown environment may be production.\n */\n const dataSeedAdmission = admitDataSeedsForApplicationEnvironment(declaredDataSeeds ?? [], readDeclaredApplicationEnvironment(process.env));\n const dataSeeds: DataSeedDefinition[] | undefined = declaredDataSeeds === undefined ? undefined : [...dataSeedAdmission.admitted];\n if (dataSeedAdmission.withheldSeedKeys.length > 0) {\n this.logger.info('Data seeds withheld in this runtime environment', {\n applicationEnvironment: readDeclaredApplicationEnvironment(process.env) ?? 'undeclared',\n withheldSeedKeys: dataSeedAdmission.withheldSeedKeys,\n });\n }\n\n // Resolved ONCE, here, so every gated validator below reads the same\n // decision. Resolving per-call-site would let two validators disagree\n // about the runtime they are validating.\n const bootAssertions = resolveApplicationRuntimeProfileBootAssertions(runtimeProfile);\n /**\n * Kept on the instance so LATER boot steps can consult the same profile this method resolved.\n * Boot steps run as separate methods, and one that has to re-derive the profile is one that\n * can derive it differently — the assertions exist precisely so every step reads one answer.\n */\n this.resolvedRuntimeProfile = runtimeProfile;\n\n try {\n this.logDebug('🚀 Starting backend application initialization...');\n // Step 1: Initialize application configuration\n this.logDebug('📋 Initializing application configuration...');\n\n // Persist platform mode for validation differences\n this.isPlatformMode = !!isPlatformApplication;\n\n if(!isPlatformApplication) {\n await this.appConfigService.initialize();\n if (providerRuntime) {\n this.appConfigService.applyProviderRuntime(providerRuntime);\n }\n this.appConfigService.applyBackendConfig(backendConfig ?? {});\n if (backendConfig) {\n this.logger.info('Backend config applied', {\n sections: Object.keys(backendConfig),\n });\n }\n this.appConfigService.assertNoPreOverridePlaceholders();\n this.logDebug('✅ Application configuration initialized successfully');\n\n /*\n * ANNOUNCE the abuse-throttle relaxation, loudly (#499).\n *\n * In DEVELOPMENT / TEST every abuse-throttle maximum is multiplied by a thousand, decided\n * from the resolved environment alone. That keeps one source of truth for \"what kind of\n * host is this\" instead of a second flag that can disagree with it — the deliberate\n * choice — and it means a host which merely REPORTS development runs with effectively no\n * abuse ceilings. Until now nothing said so at any volume.\n *\n * At `warn` rather than `info`, and naming the sites rather than saying \"abuse limits\n * relaxed\": an operator reading the vague form would reasonably assume ALL throttles, and\n * product-policy counters and audit de-duplication windows are deliberately untouched.\n * Silent in STAGING / PRODUCTION, where the descriptor returns null.\n */\n const throttleRelaxation = describeAbuseThrottleRelaxation(this.appConfigService.applicationEnv);\n if (throttleRelaxation) {\n this.logger.warn(\n `⚠️ ABUSE THROTTLES RELAXED ×${throttleRelaxation.multiplier} — this host reports `\n + `environment \"${throttleRelaxation.applicationEnv}\", so the ceilings below are effectively absent. `\n + `Relaxed: ${throttleRelaxation.relaxedSites.join(', ')}. `\n + 'Product-policy counters and audit de-duplication windows are NOT relaxed.',\n { applicationEnv: throttleRelaxation.applicationEnv, multiplier: throttleRelaxation.multiplier, relaxedSites: throttleRelaxation.relaxedSites },\n );\n }\n /**\n * Establish the default MongoDB connection — ONLY when this application has a\n * MongoDB to connect to.\n *\n * The loader builds `database.mongodb` only when the environment supplies\n * `MONGODB_HOST`, so its ABSENCE is the application saying it has no MongoDB. Until\n * 2026-08-28 this connect was unconditional and rethrowing, which made a mongod a\n * hard boot requirement for every application — including one whose every resource\n * is on PostgreSQL.\n *\n * Contrast the two blocks immediately below: Redis degrades to in-memory with a\n * warning, and file storage is explicitly non-fatal. MongoDB was the only backing\n * service that could refuse a boot by being absent rather than by being broken.\n *\n * It stays FATAL when a MongoDB IS declared and the connection fails — that is a\n * real outage and must not be softened into a warning.\n *\n * ## The gate is the SELECTION, not the address (2026-09-19)\n *\n * This read `config.database?.mongodb` — the branch the loader builds from\n * `MONGODB_HOST` alone. That is an ADDRESS, and an environment legitimately hosts a\n * mongod for OTHER applications: `wonder-todos` is PostgreSQL on both planes, keeps\n * its RAG corpus in pgvector, has never written a document, and still opened this\n * connection at every boot and kept it alive on a 30s timer.\n *\n * PostgreSQL never had this problem — its address is emitted the same way and\n * nothing connects unless `defaultAdapter` selects it. MongoDB now asks the same\n * question. A resource PINNED to MongoDB on a PostgreSQL-default application is\n * unaffected: the address is still in config, so its repository connects on demand\n * through `ensureConnection()` when the registry builds it — which is later than\n * this line, and is the reason the registry cannot be consulted here.\n */\n if (mongoDbIsSelectedStore(this.appConfigService.config.database)) {\n try {\n await this.mongoDBService.connect();\n this.logDebug('✅ MongoDB default connection established');\n } catch (e) {\n this.logger.error('❌ MongoDB default connection failed', e as any);\n throw e;\n }\n } else {\n this.logDebug('↷ No MongoDB configured for this application — skipping the default connection.');\n }\n // Establish Redis connection for caching, sessions, and WebSocket sync\n // Redis is optional - graceful fallback to in-memory if unavailable\n try {\n await this.redisService.connect();\n this.logDebug('✅ Redis connection established');\n } catch (e) {\n this.logger.warn('⚠️ Redis connection failed, using in-memory fallbacks', { ...projectCaughtErrorLogFields(e) });\n }\n\n // Initialize file storage (MinIO/S3) — optional, skipped when not configured\n if (this.fileStorageRouter.isConfigured()) {\n try {\n await this.fileStorageRouter.initialize();\n this.logDebug('✅ File storage initialized');\n } catch (e) {\n // Non-fatal AND not final. An application backend fetches short-lived storage\n // credentials from apps-manager, so a backend that boots BEFORE its issuer is\n // listening fails here with ECONNREFUSED through no fault of its own — an\n // ordinary outcome of concurrent respawn.\n //\n // `WildoManagedStorageProvider.healthCheck()` retries acquisition on every\n // readiness probe, so this clears WITHOUT a restart once the issuer is up\n // (proven live on a platform service 2026-08-13: same PID, monotonic uptime,\n // unhealthy → healthy). The previous wording — \"file operations will fail at\n // runtime\" — described the behaviour before that recovery existed, and now\n // sends whoever greps this log hunting a defect that will have fixed itself.\n this.logger.warn('⚠️ File storage initialization failed at startup — will retry on each readiness probe', { ...projectCaughtErrorLogFields(e) });\n }\n } else {\n this.logDebug('📦 File storage not configured, skipping initialization');\n }\n }\n\n // This is the only application-config read allowed before the\n // platform subclass hydrates AppConfigurationService. The helper\n // branches before evaluating the throwing getter, then every\n // startup decision below consumes this resolved boundary value.\n const applicationConfig = resolveApplicationConfigForStartup(this.appConfigService, isPlatformApplication);\n\n if (applicationConfig) {\n // `!headlessMode` is the auth-SERVING runtime, the same line Step 8.5 draws below.\n this.applicationStartupConfigValidator.validate(applicationConfig, { servesAuthentication: !headlessMode });\n }\n\n /*\n * Step 1.4: the systems of record this application declared (#1055 E9, R8).\n *\n * HERE — after the configuration validator, before resource registration — and the window is\n * narrow for a measured reason. Registration is where a resource's `httpApiBinding` is\n * checked against the instance it names, so the registry must already hold the declarations\n * by then. It must NOT be later still: the providers registry initialises after\n * registration, and #1054's owner-organization resolver needs the repositories registry,\n * later again. Resolving the owner eagerly here would deadlock the two, which is why it is\n * deliberately LAZY and why this step reads only the declaration and the facet map.\n *\n * It never dials a remote. An ERP outage must not stop an application booting.\n */\n /*\n * ONLY on the application BACKEND (#1055 D2, E8) — and this gate was MISSING, which a\n * running stack found before any test did.\n *\n * D2 says the instance's address and credential reach the backend runtime and nothing\n * else, and the env builder implements that: a minion's `.env` carries no `WILDO_SOR_*`\n * at all. What was not implemented is the other half — this registry ran on a MINION too,\n * looked for the values D2 had just withheld from it, and refused. The minion died at boot\n * over a system of record it has no lane to read.\n *\n * The invariant was applied at the delivery site and not at the site that CONSUMES the\n * delivery, which is `invariant-call-site-enumeration.md`'s whole subject. On any other\n * runtime the registry stays empty, and the registration arm skips its instance checks\n * for exactly that reason.\n */\n if (this.systemsOfRecordRegistry && this.resolvedRuntimeProfile === ApplicationRuntimeProfile.APPLICATION_BACKEND) {\n /*\n * The facet resolver is built HERE rather than imported as a function, because it\n * needs the artifact this process was generated with: `systemOfRecordFacetModules`\n * is what makes a PACKAGE-shipped facet reachable (#1057), and the engine ships\n * none any more.\n *\n * An application with no artifact — or one generated before that field existed —\n * gets an empty list and resolves nothing. When it DECLARES systems of record, that\n * is refused right here, naming the stale artifact: letting it fall through produced\n * `SYSTEM_OF_RECORD_VENDOR_HAS_NO_FACET` (\"misspelled, or the package is not\n * installed\") for a vendor that was spelled right and installed — the only thing\n * wrong was an artifact from before the field (measured 2026-09-24, Wonder Todos,\n * after providers-hardening landed). A PRESENT but empty list is a current artifact\n * whose packages ship no facet, and the registry's own refusal is the right one.\n */\n const declaredSystems = Object.keys(applicationConfig?.systemsOfRecord ?? {});\n if (declaredSystems.length > 0 && providerRuntime?.systemOfRecordFacetModules === undefined) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n code: SystemOfRecordErrorCode.FACET_MODULES_NOT_GENERATED,\n systems: declaredSystems,\n message: `This application declares systems of record (${declaredSystems.join(', ')}), but its provider `\n + 'runtime artifact lists no facet modules — it was generated before systems of record existed, or '\n + 'not at all, so no vendor facet can be found. Regenerate it: `wildo config sync --domain=env-files` '\n + '(or `wildo dev start`) in the application, then restart the backend.',\n },\n });\n }\n await this.systemsOfRecordRegistry.initialize(\n applicationConfig?.systemsOfRecord,\n createSystemOfRecordFacetResolver({\n facetModules: providerRuntime?.systemOfRecordFacetModules,\n }),\n undefined,\n undefined,\n /*\n * #1057 R5 — consulted only when a vendor has no facet, to say WHICH vendor\n * carries it. The same modules as the facet resolver above, because an alias and\n * the facet it points at are declared by the same catalogue.\n */\n createSystemOfRecordVendorAliasResolver({\n facetModules: providerRuntime?.systemOfRecordFacetModules,\n }),\n );\n }\n\n // Step 1.5: Initialize roles configuration\n this.logDebug('🔐 Initializing roles configuration...');\n if (customRoles) {\n this.authorizationsService.initializeRolesWithCustom(customRoles);\n this.logDebug('✅ Roles configuration initialized with custom roles');\n } else {\n // Roles are already initialized with defaults in the constructor\n this.logDebug('✅ Roles configuration using default roles only');\n }\n\n // Service-provider declarations (#1597), checked against the LIVE role table built one step\n // above — the first moment it exists. Fail closed: a provider role that reaches ORG_ADMIN would\n // hand every expert of every firm administration of every client; a role unavailable in a\n // client type would make every acceptance refuse at runtime. Neither may boot.\n const serviceProviderViolations = collectServiceProviderDeclarationViolations({\n organizationTypes: (this.appConfigService.isInitialized() ? this.appConfigService.config.organizationTypes : undefined) as never,\n administrationAnchorRole: CORE_ORG_ROLES.ORG_ADMIN,\n organizationRoleHierarchy: (role) => this.authorizationsService.getRoleHierarchy(role as never, ResourcePrimaryScope.ORGANIZATIONS),\n });\n if (serviceProviderViolations.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n reason: 'service_provider_declaration_violation',\n violations: serviceProviderViolations,\n message: 'An organization type\\'s `servesAsProvider` declares a role that reaches ORG_ADMIN, is undeclared, '\n + 'is unavailable in a client type, or is a delegated capability role (ORG_DELEGATED_*, lent only by a '\n + 'dated grant). Fix `organizationTypes` in wildo.saas.config.ts and run '\n + '`wildo config reapply-declaration`.',\n },\n });\n }\n\n // Expert-approval deadlines (#1909): a client type's `acceptsServiceProviders.expertApprovalDeadlines` is\n // #1628's declaration on a plane that offers only an answer, so a claim, a reassignment or a pause state could\n // never do what it says — refused rather than half-honoured, like every other deadline declaration.\n {\n const configuredTypes = (this.appConfigService.isInitialized() ? this.appConfigService.config.organizationTypes : undefined) ?? {};\n const calendarDeclared = this.appConfigService.isInitialized() && !!this.appConfigService.config.reviewCalendar;\n const expertApprovalDeadlineIssues = Object.entries(configuredTypes).flatMap(([organizationType, definition]) =>\n serviceProviderExpertApprovalDeadlinesIssues(\n (definition as { acceptsServiceProviders?: { expertApprovalDeadlines?: ReviewDeadlinesDeclaration } } | undefined)?.acceptsServiceProviders?.expertApprovalDeadlines,\n { calendarDeclared },\n ).map((issue) => `${organizationType}: ${issue}`));\n if (expertApprovalDeadlineIssues.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n reason: 'service_provider_expert_approval_deadlines_invalid',\n issues: expertApprovalDeadlineIssues,\n message: 'An organization type\\'s `acceptsServiceProviders.expertApprovalDeadlines` asks for something an expert approval '\n + 'cannot do. Fix `organizationTypes` in wildo.saas.config.ts.',\n },\n });\n }\n }\n\n // Delegated capability roles (#1631), against the same LIVE table: an application may redefine a role, and a\n // capability role that inherits toward ORG_ADMIN / ORG_OWNER would turn a narrow, time-bound delegation into\n // administration of the client. Nor may one be missing — a grant of it would confer nothing, silently.\n const capabilityRoleViolations = collectDelegatedCapabilityRoleViolations({\n organizationRoleHierarchy: (role) => this.authorizationsService.getRoleHierarchy(role as never, ResourcePrimaryScope.ORGANIZATIONS),\n administrationAnchorRoles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_OWNER],\n organizationRoles: Object.keys(this.authorizationsService.getOrgRoles() ?? {}),\n });\n if (capabilityRoleViolations.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n reason: 'delegated_capability_role_violation',\n violations: capabilityRoleViolations,\n message: 'A delegated administrative capability role (ORG_DELEGATED_*) is missing from the organization role table, '\n + 'inherits toward ORG_ADMIN / ORG_OWNER, or is inherited by another role. A capability must confer exactly the '\n + 'operations that name it, and only through a live grant.',\n },\n });\n }\n\n /*\n * The role expansion the resources registry needs to check a PARTITIONED system of\n * record's reach (#1058 R1). Wired HERE because this is the first moment both exist:\n * roles were initialised one step above, and the registry runs one step below.\n *\n * A setter rather than a constructor dependency — `AuthorizationsBackendService` already\n * depends on the registry, so injecting it back would close a cycle — and rather than a\n * tenth positional parameter on `initialize`, which under `strict: false` is a position a\n * caller can get wrong silently (#1250).\n */\n this.resourcesRegistryService.useRoleHierarchyResolver(\n (role, scope) => this.authorizationsService.getRoleHierarchy(role as never, scope),\n );\n\n // Step 2: Initialize resources registry with all 4 sources\n this.logDebug('🔧 Initializing resources registry...');\n\n // Read lifecycle config early — needed for both resource exclusion and evaluator init\n // Platform apps don't use lifecycle, billing, or feature gating\n const lifecycleConfig: LifecycleConfig | undefined = applicationConfig?.lifecycle;\n\n // Compute excluded resource types based on app configuration.\n // When billing/lifecycle is disabled, their resource types are excluded\n // from the registry (no routes, no repositories, no frontend resources).\n // When billing IS enabled, scope variants for scopes not in enabledScopes\n // are also excluded (e.g., USER variants when only ORG billing is enabled).\n const excludedResourceTypes = resolveFeatureGatedCoreResourceExclusions(\n applicationConfig,\n { isPlatformApplication },\n );\n\n if (excludedResourceTypes) {\n this.logDebug(`Feature-gated resources excluded: ${excludedResourceTypes.size} types`, {\n billingDisabled: !applicationConfig?.billing?.enabled,\n billingDisabledScopes: (() => {\n const billingConfig = applicationConfig?.billing;\n if (!billingConfig?.enabled) return 'all';\n const enabledSet = new Set<string>(billingConfig.enabledScopes ?? []);\n return BILLING_SCOPES.filter(s => !enabledSet.has(s));\n })(),\n lifecycleDisabled: !lifecycleConfig?.enabled,\n });\n }\n\n await this.resourcesRegistryService.initialize(\n sharedResourceConfigurations,\n sharedResourceFieldIdentifiers,\n sharedResourceRelationships,\n (backendResourceConfigurations ?? {}) as ResourceConfiguration_InitializationFactoryMap,\n backendResourceFieldIdentifiers,\n backendResourceRelationships,\n notificationBadgeDefinitions,\n undefined, // customAdditionalUserNotificationDefinitions\n excludedResourceTypes,\n organizationUnitNarrowing,\n serviceProviderOrganizationWideAccess,\n );\n this.logDebug('✅ Resources registry initialized successfully');\n if (applicationConfig && afterResourcesRegistryInitialized) {\n await afterResourcesRegistryInitialized({\n appConfig: applicationConfig,\n resourcesRegistryService: this.resourcesRegistryService,\n errorBuilder: this.errorBuilder,\n });\n this.logDebug('✅ Runtime-specific resource-catalog hook completed');\n }\n\n this.pdfTemplateBindingService.initialize(pdfTemplateBindings ?? {}, {\n assertCompleteness: bootAssertions.assertsGeneratedPdfBindingCompleteness,\n });\n this.logDebug('✅ PDF template bindings initialized successfully');\n this.pdfCollectionExportTemplateService?.initialize(pdfCollectionExportTemplates ?? [], {\n assertCompleteness: bootAssertions.assertsGeneratedPdfBindingCompleteness,\n });\n\n // Step 2.0.1: Initialize feature definition registry\n this.logDebug('🏷️ Initializing feature definition registry...');\n this.featureDefinitionRegistryService.registerCoreFeatures();\n if (customFeatureDefinitions && customFeatureDefinitions.length > 0) {\n this.featureDefinitionRegistryService.registerCustomFeatures(customFeatureDefinitions);\n }\n this.featureDefinitionRegistryService.validateDefinitions();\n this.featureDefinitionRegistryService.logStartupSummary();\n\n // Build and set the merged FeatureConfiguration (profiles + policy)\n if (customFeatureConfiguration) {\n const allDefinitions = this.featureDefinitionRegistryService.getAllDefinitions();\n this.featureDefinitionRegistryService.setConfiguration({\n definitions: allDefinitions,\n profiles: customFeatureConfiguration.profiles ?? {},\n defaultProfile: customFeatureConfiguration.defaultProfile,\n unavailabilityPolicy: {\n defaultBehavior: customFeatureConfiguration.unavailabilityPolicy?.defaultBehavior ?? FeatureUnavailabilityBehavior.UPGRADE_PROMPT,\n whenBillingDisabled: customFeatureConfiguration.unavailabilityPolicy?.whenBillingDisabled ?? FeatureUnavailabilityBehavior.HIDE,\n roleDefaults: customFeatureConfiguration.unavailabilityPolicy?.roleDefaults ?? {},\n reasonDefaults: customFeatureConfiguration.unavailabilityPolicy?.reasonDefaults ?? {\n [FeatureUnavailabilityReason.FEATURE_NOT_ENABLED]: FeatureUnavailabilityBehavior.UPGRADE_PROMPT,\n [FeatureUnavailabilityReason.LIMIT_EXCEEDED]: FeatureUnavailabilityBehavior.LIMIT_UPGRADE_PROMPT,\n [FeatureUnavailabilityReason.NOT_CONFIGURED]: FeatureUnavailabilityBehavior.HIDE,\n },\n },\n });\n this.logDebug('✅ Feature configuration set (profiles + unavailability policy)');\n }\n const analyticsValueMoments = applicationConfig?.analytics?.valueMoments;\n\n this.featureDefinitionRegistryService.warnMisplacedLimitFeatures();\n this.featureDefinitionRegistryService.warnInvalidFeatureReferences({\n featureProfiles: customFeatureConfiguration?.profiles,\n chartDefinitions,\n guidanceFlowDefinitions,\n productDefinitions,\n analyticsValueMoments,\n referralRewards: [applicationConfig?.billing?.referrals?.referrerReward, applicationConfig?.billing?.referrals?.referredReward],\n });\n this.logDebug('✅ Feature definition registry initialized successfully');\n\n // Step 2.0.2: Initialize milestone definition registry\n this.logDebug('🏅 Initializing milestone definition registry...');\n if (customMilestoneConditions && customMilestoneConditions.length > 0) {\n for (const { ref, fn } of customMilestoneConditions) {\n this.milestoneConditionRegistry.registerCondition(ref, fn);\n }\n this.logDebug(`Registered ${customMilestoneConditions.length} custom milestone condition(s)`);\n }\n if (customMilestoneDefinitions && customMilestoneDefinitions.length > 0) {\n this.milestoneDefinitionRegistry.registerCustomMilestones(customMilestoneDefinitions);\n this.milestoneDefinitionRegistry.validateDefinitions();\n this.milestoneDefinitionRegistry.logStartupSummary();\n }\n this.logDebug('✅ Milestone definition registry initialized successfully');\n\n /*\n * Step 2.0.2b: value moment definitions + their backend handlers.\n *\n * Until #414 `analyticsValueMoments` was read ONCE, a few lines above, purely to warn\n * about invalid feature references — and then discarded. So the engine had nothing to\n * evaluate, and the two `analytics.persistence.*` defaults promised an application\n * cross-device persistence and authoritative evaluation it could not receive.\n *\n * Handlers register BEFORE definitions so a definition naming one is never briefly\n * evaluable against a registry that does not hold it.\n */\n if (valueMomentHandlers && valueMomentHandlers.length > 0) {\n for (const { ref, fn } of valueMomentHandlers) {\n this.valueMomentHandlerRegistry.registerHandler(ref, fn);\n }\n this.logDebug(`Registered ${valueMomentHandlers.length} value moment handler(s)`);\n }\n if (analyticsValueMoments && analyticsValueMoments.length > 0) {\n this.valueMomentDefinitionRegistry.registerDefinitions(analyticsValueMoments);\n this.valueMomentDefinitionRegistry.validateDefinitions();\n this.valueMomentDefinitionRegistry.logStartupSummary();\n }\n\n // Step 2.0.3: Initialize lifecycle evaluator configuration\n /*\n * `evaluatesSubjectLifecycle` as well as the application's own switch: the evaluator\n * runs on every service-tier write and reads/creates the application-wide lifecycle\n * singletons, which a confined runtime neither holds grants over nor owns. Leaving the\n * config unset is what makes it inert — `onOperation` returns immediately without one.\n */\n if (!isPlatformApplication && lifecycleConfig?.enabled && bootAssertions.evaluatesSubjectLifecycle) {\n this.logDebug('🔄 Initializing lifecycle evaluator...');\n this.lifecycleEvaluator.setLifecycleConfig(lifecycleConfig);\n\n // Late-binding initialization for lifecycle custom implementations\n initializeLifecycleCustomImplementations(this.lifecycleEvaluator, lifecycleConfig, this.errorBuilder);\n\n // Validate activation criteria refs against registries\n if (lifecycleConfig.activationCriteria?.criteria) {\n for (const criterion of lifecycleConfig.activationCriteria.criteria) {\n /*\n * A DOT in a criterion ref silently nests the stored key. Each met criterion\n * is recorded as `activationCriteriaMet.${ref}`, a PATH-KEYED mutation both\n * adapters compile as a nested write, while the evaluator reads the FLAT key\n * (`progressionState.milestonesAchieved[criterion.milestoneRef]`). The\n * criterion is written and never reads as met, so activation never completes\n * — silently, because nothing throws.\n */\n const criterionRef = criterion.criterionType === ActivationCriterionType.MILESTONE\n ? criterion.milestoneRef\n : criterion.guidanceFlowRef;\n if (typeof criterionRef === 'string' && criterionRef.includes('.')) {\n this.logger.warn(\n `Lifecycle activation criterion ref '${criterionRef}' contains '.', the mutation path separator — `\n + 'it will be stored nested and can never read as met',\n );\n }\n if (criterion.criterionType === ActivationCriterionType.MILESTONE) {\n /*\n * Only a runtime that RECEIVES milestone definitions may call a ref\n * unknown. A minion's scoped projection carries none, so its registry is\n * empty by construction and every criterion looks unresolvable — the\n * lookup could not ask, which is not the same as an absent milestone\n * (`.claude/rules/negative-results-require-a-positive-probe.md`).\n */\n if (!bootAssertions.assertsLifecycleActivationCriteriaResolvability) {\n this.logDebug(\n `Lifecycle activation criterion '${criterion.milestoneRef}' not checked — `\n + `runtime profile '${runtimeProfile}' carries no milestone definitions`,\n );\n } else if (!this.milestoneDefinitionRegistry.getDefinition(criterion.milestoneRef)) {\n this.logger.warn(`Lifecycle activation criterion references unknown milestone: '${criterion.milestoneRef}'`);\n }\n } else if (criterion.criterionType === ActivationCriterionType.GUIDANCE_COMPLETED) {\n this.logDebug(`Lifecycle activation criterion references guidance flow: '${criterion.guidanceFlowRef}' (validated at runtime)`);\n }\n }\n }\n\n this.logDebug('✅ Lifecycle evaluator configured', {\n dormancyThresholdDays: lifecycleConfig.dormancyThresholdDays,\n activityDebounceMinutes: lifecycleConfig.activityDebounceMinutes,\n dormancyCronSchedule: lifecycleConfig.dormancyCronSchedule,\n activationCriteriaCount: lifecycleConfig.activationCriteria?.criteria?.length ?? 0,\n });\n } else if (!isPlatformApplication) {\n this.logDebug('🔄 Lifecycle system disabled (lifecycle.enabled = false or not configured)');\n }\n\n // Step 2.1: LOAD, then initialize, the first-class backend provider registry.\n //\n // The loader imports EXACTLY the refs `providerRuntime` declares — an\n // application-supplied module first, then the engine's on-demand map, then a\n // dynamic import of the package the artifact names for that ref (#330). Nothing\n // this process did not declare is evaluated, which is what stops a worker that\n // declares one email provider from pulling six model SDKs into its boot graph.\n //\n // `initialize` then re-filters against the same artifact and fails startup loudly\n // for any ref that did not resolve, quoting the loader's reason. Minion and worker\n // startup reach this same step by delegating here with their per-host projected\n // artifact, so all three hosts load identically.\n this.logDebug('📦 Loading backend providers...');\n const resolvedProviders = await resolveBackendProviderRegistry({\n providerRuntime,\n applicationFragment: backendProviderRegistry,\n });\n this.backendProviderRegistryService.initialize(\n resolvedProviders.registry,\n providerRuntime,\n resolvedProviders.unresolved,\n );\n this.logDebug('✅ Backend provider registry initialized', {\n providerRuntimeApplied: Boolean(providerRuntime),\n providerCount: this.backendProviderRegistryService.getRegistry().modules.size,\n });\n\n // Step 2.2: Initialize external providers registry.\n // Skip for platform applications - they initialize config later and will refresh the registry\n if (applicationConfig) {\n this.logDebug('🔌 Initializing external providers registry...');\n await this.externalProvidersRegistryService.initialize();\n this.logDebug('✅ External providers registry initialized successfully');\n\n // F5 (audit Phase 5) + #328 — required-capability floor. Fail LOUD if any capability\n // the app marked `required`, or any ENABLED engine flow slot (email, billing, SMS),\n // resolves no active provider. The door lives on the registry so the platform\n // services run the same check after their own `refreshFromConfig()`; the engine\n // half is profile-gated because a minion's scope-filtered registry serves none of\n // those slots by design.\n this.externalProvidersRegistryService.assertRequiredCapabilityFloor({\n includeEngineFloor: bootAssertions.assertsEngineCapabilityProviderFloor,\n });\n\n // G4 (audit Phase 5) — fail-OPEN audit-sink reconcile. Distinct from the\n // F5 hard guard above: this WARNS (never throws) when COMPLIANCE_AUDIT_TRAIL\n // is ENABLED but no provider resolves to deliver it — the operator turned on\n // Layer-2 audit fan-out yet nothing serves it (Layer-1 database audit is\n // unaffected). Mirrors ObservabilityBackendService's declared-but-inactive\n // reconcile. The resolved-provider-refs check is the faithful proxy for \"the\n // composite resolves zero live sinks\" (it builds one sink per resolved ref).\n // A `required` audit cap with no provider already threw in F5 above, so this\n // only fires for an enabled-but-not-required capability.\n //\n // Gated on the runtime profile: only a runtime EXPECTED to host the Layer-2\n // audit fan-out (the application backend) treats \"enabled but no provider\" as\n // a misconfiguration. An auxiliary runtime such as a minion is Layer-1-only by\n // design — the immudb node client is installed only in the backend, and the\n // backend's `immudb.audit-reconcile` cron backfills the minion's `AUDIT_LOGS`\n // rows into Layer-2 — so warning there is false-alarm noise on every restart,\n // not a real signal. `assertsLayer2AuditProviderPresence` is read off the same\n // `bootAssertions` decision resolved once above, so this gate cannot disagree\n // with the sibling profile-gated validators about which runtime is booting.\n const resolvedAuditProviderRefs = this.externalProvidersRegistryService.getResolvedProviderRefsForCapability(\n EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n );\n const layer2AuditGateInput = {\n runtimeAssertsLayer2AuditProviderPresence: bootAssertions.assertsLayer2AuditProviderPresence,\n complianceAuditTrailEnabled: this.externalProvidersRegistryService.isEngineCapabilityEnabled(\n EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n ),\n resolvedAuditProviderRefCount: resolvedAuditProviderRefs.length,\n };\n // The healthy branch is recorded POSITIVELY (#1413): silence is also what a Layer-1-only\n // runtime and a disabled capability produce, so evidence of an active fan-out must not be\n // inferred from the absence of the warning below.\n if (shouldRecordLayer2AuditFanOutActive(layer2AuditGateInput)) {\n this.logger.info(LAYER2_AUDIT_FAN_OUT_ACTIVE_MESSAGE, { resolvedAuditProviderRefs: [...resolvedAuditProviderRefs].sort() });\n }\n if (shouldWarnLayer2AuditProviderInactive(layer2AuditGateInput)) {\n this.logger.warn(\n 'COMPLIANCE_AUDIT_TRAIL is enabled but no audit-log provider resolves — Layer-2 provider '\n + 'audit fan-out is INACTIVE (Layer-1 database audit is unaffected). Declare an audit provider '\n + '(e.g. immudb) in defineSaaSProviders, or disable the capability if Layer-1 alone is intended.',\n );\n }\n } else {\n this.logDebug('🔌 Skipping external providers registry initialization (platform app - will initialize after config is ready)');\n }\n\n // Step 2.3: Initialize flows-actors registry\n this.logDebug('🎭 Initializing flows-actors registry...');\n const mergedFlowActorSystemsFactoryMap = {\n ...(flowsActorsRegistry?.flowActorSystemsFactoryMap || {}),\n };\n const mergedAgents = [\n ...(flowsActorsRegistry?.agents || []),\n ];\n const mergedFunctionTools = [\n ...(flowsActorsRegistry?.functionTools || []),\n ];\n await this.flowsActorsRegistryService.initialize(\n mergedFlowActorSystemsFactoryMap,\n mergedAgents,\n mergedFunctionTools,\n undefined,\n flowsActorsRegistry?.autonomousAgents ?? [],\n );\n this.logDebug('✅ Flows-actors registry initialized successfully');\n\n // Step 2.3b: Register the app's NAMED external resource-server instances (multiple MCP\n // servers / A2A agents) and validate their membership refs. Runs HERE deliberately — after\n // BOTH the resources registry (Step 2.1, for `operation.mcp.servers`) and the flows-actors\n // registry (Step 2.3, for an agent's `actorSystemRefs`) — because validation resolves refs\n // against them. A bad ref throws a CONFIGURATION error and fails startup (fail-closed):\n // a tool that silently belongs to no catalog, or a card advertising an unroutable skill,\n // is worse than a refusal to boot.\n // Membership validation is gated on the runtime profile: it asserts that every\n // `operation.mcp.servers` / `actorSystemRefs` ref resolves to a declared instance,\n // which is only meaningful for a runtime that actually SERVES those transports.\n // A minion mounts none and carries no declarations, so running this would fail its\n // boot over refs describing a surface it cannot expose — the exact crash-loop that\n // motivated the profile mechanism. Registration itself always runs: an empty\n // registry is the correct state for a non-serving runtime, and `tryGetInstance`\n // callers stay fail-closed against it.\n this.logDebug('🔀 Registering external resource-server instances...');\n this.resourceServerInstancesRegistry.initialize(resourceServerInstances);\n if (bootAssertions.assertsResourceServerMembershipCompleteness) {\n this.resourceServerInstancesRegistry.validateDeclaredMembership(\n this.flowsActorsRegistryService.getActors().map((system) => system.ref),\n this.flowsActorsRegistryService\n .getActors()\n .filter((system) => system.visibility !== FlowActorSystem_Visibility.FRONTEND)\n .map((system) => system.ref),\n );\n this.logDebug('✅ External resource-server instances registered + validated');\n } else {\n this.logDebug('✅ External resource-server instances registered (membership validation N/A for this runtime profile)', {\n runtimeProfile,\n });\n }\n\n // Step 2.4: Initialize I18n service with custom labels\n this.logDebug('🌐 Initializing I18n service...');\n this.i18nService.initialize(customLabels || {}, {\n suppressEmptyWarning: isPlatformApplication,\n });\n this.logDebug('✅ I18n service initialized successfully');\n\n // Step 2.4b: Initialize email template registry\n if (emailTemplateDefinitions && Object.keys(emailTemplateDefinitions).length > 0) {\n this.emailTemplateRegistryService.initialize(emailTemplateDefinitions);\n }\n\n if (!isPlatformApplication) {\n // Reconcile OTLP observability (post-config): compare the `--import` preload's\n // runtime state against the OBSERVABILITY_TELEMETRY provider selection, warn on\n // mismatch (E11), and wire graceful telemetry flush into the shutdown coordinator.\n // `?.` — platform subclasses don't forward this arg (see the constructor note); this\n // branch is non-platform so it's always defined here, but the guard is defensive.\n this.observabilityBackendService?.initialize();\n }\n\n // Step 2.5: Register chart definitions\n if (chartDefinitions && chartDefinitions.length > 0) {\n this.logDebug('📊 Registering chart definitions...', { count: chartDefinitions.length });\n for (const chartDef of chartDefinitions) {\n this.chartRegistryService.registerChart(chartDef);\n }\n this.logDebug('✅ Chart definitions registered successfully', { count: chartDefinitions.length });\n } else {\n this.logDebug('📊 No chart definitions provided, skipping chart registration');\n }\n\n // Step 2.5b: Register guidance flow definitions\n if (guidanceFlowDefinitions && guidanceFlowDefinitions.length > 0) {\n this.logDebug('🧭 Registering guidance flow definitions...', { count: guidanceFlowDefinitions.length });\n this.guidanceTriggerEvaluator.initializeFlows(guidanceFlowDefinitions);\n this.logDebug('✅ Guidance flow definitions registered successfully', { count: guidanceFlowDefinitions.length });\n } else {\n this.logDebug('🧭 No guidance flow definitions provided, skipping guidance registration');\n }\n\n // Step 2.6: Debug URL generation\n this.logDebug('🌐 Displaying generated URLs for debugging...');\n this.resourcesRegistryService.debugDisplayGeneratedUrls();\n\n // Step 3: Initialize repositories registry\n this.logDebug('🗄️ Initializing repositories registry...');\n const resourcesRegistry = this.resourcesRegistryService.getResourcesRegistry();\n\n // Guardrail: a REQUIRED composition-parent FK that the user must supply on\n // org-wide create (the parent is OPTIONAL_CONTEXT/STANDALONE) must be\n // user-fillable — otherwise the create form is silently dead (the\n // todoListId-create class of bug). Surface violations at boot rather than as\n // an unexplained client-side validation failure.\n //\n // Severity split: TARGET_NOT_SEARCHABLE degrades the picker → WARN (a custom\n // create surface might still supply the FK). EXCLUDED_FROM_CREATE is genuinely\n // impossible to create (no context, no control) → FAIL loud so the misconfig\n // never ships. The validator call itself is try/catch-guarded so a validator\n // edge case can never block startup; the intentional FAIL throw is outside\n // that guard so it propagates.\n let fkFillabilityViolations: ForeignKeyFillabilityViolation[] = [];\n try {\n fkFillabilityViolations = validateRequiredForeignKeyFillability(\n resourcesRegistry.resourceConfigurations as any,\n );\n } catch (error) {\n this.logger.warn('⚠️ required-foreign-key fillability guardrail skipped (validation error)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n for (const violation of fkFillabilityViolations) {\n if (violation.severity === ForeignKeyFillabilityViolationSeverity.WARN) {\n this.logger.warn(`⚠️ Required foreign key may be unfillable on create [${violation.kind}]: ${violation.message}`, {\n resourceType: violation.resourceType,\n foreignKeyField: violation.foreignKeyField,\n parentResourceType: violation.parentResourceType,\n kind: violation.kind,\n });\n }\n }\n const fkFillabilityFailures = fkFillabilityViolations.filter(\n (violation) => violation.severity === ForeignKeyFillabilityViolationSeverity.FAIL,\n );\n if (fkFillabilityFailures.length > 0) {\n throw new Error(\n `Resource configuration error — ${fkFillabilityFailures.length} required foreign key(s) are impossible to fill on create:\\n` +\n fkFillabilityFailures.map((failure) => ` • ${failure.message}`).join('\\n'),\n );\n }\n\n // --- Initiator-stamped field guard (#584) ---\n // FAIL-CLOSED: a REQUIRED `createdByUserId` / `updatedByUserId` / `lastUpdatedByUserId` cannot be\n // satisfied by a machine principal — the client may not send it and the repository stamps it only\n // from a userId — so a machine write to that resource fails, or commits and then fails to describe\n // itself. It was a boot REPORT while flipping the existing declarations was believed to owe\n // PostgreSQL migrations; it does not (the planner contract records no nullability), so the\n // declaration is refused here instead of being discovered by the first machine caller. The\n // validator call is try/catch-guarded so a validator edge case can never block startup; the\n // intentional throw is outside that guard. See `validateInitiatorStampedFieldSatisfiability`.\n let initiatorStampedViolations: InitiatorStampedFieldViolation[] = [];\n try {\n initiatorStampedViolations = validateInitiatorStampedFieldSatisfiability(resourcesRegistry.resourceConfigurations as any);\n } catch (error) {\n this.logger.warn('⚠️ initiator-stamped field guard skipped (validation error)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n if (initiatorStampedViolations.length > 0) {\n throw new Error(\n `Resource configuration error — ${initiatorStampedViolations.length} engine-stamped field(s) are REQUIRED and unsatisfiable by a machine principal:\\n` +\n initiatorStampedViolations.map((violation) => ` • ${violation.message}`).join('\\n'),\n );\n }\n\n // --- Composition-seedability guard (onParentCreate lifecycle) ---\n // FAIL-CLOSED: a composition that OPTED IN to `onParentCreate.enabled` but\n // whose child is not seedable (not default-materializable AND no override)\n // is a genuine misconfig — the runtime seed would silently no-op. It fires\n // ONLY on enabled adopters, so it never trips the dozens of on-demand\n // compositions that legitimately do not eager-seed. The validator call is\n // try/catch-guarded so a validator edge case can never block startup; the\n // intentional throw is outside that guard. See\n // .claude/plans/composition-oncreate-lifecycle.md.\n let compositionSeedabilityViolations: CompositionSeedabilityViolation[] = [];\n try {\n compositionSeedabilityViolations = validateCompositionSeedability(\n resourcesRegistry.resourceConfigurations as any,\n );\n } catch (error) {\n this.logger.warn('⚠️ composition-seedability guardrail skipped (validation error)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n for (const violation of compositionSeedabilityViolations) {\n this.logger.warn(`⚠️ [composition-seedability] ${violation.message}`, {\n childResourceType: violation.childResourceType,\n parentResourceType: violation.parentResourceType,\n missingFields: violation.missingFields,\n });\n }\n if (compositionSeedabilityViolations.length > 0) {\n throw new Error(\n `Resource configuration error — ${compositionSeedabilityViolations.length} composition relationship(s) enabled ` +\n `onParentCreate seeding but are not seedable:\\n` +\n compositionSeedabilityViolations.map((violation) => ` • ${violation.message}`).join('\\n'),\n );\n }\n\n // --- Composition cascade-DELETABILITY guard (onParentDelete lifecycle) ---\n // The delete-side counterpart of the seedability guard above. It is wired FAIL-CLOSED for\n // IMPERSONALIZE_AND_RETAIN and REFUSE_WHILE_CHILDREN_EXIST edges, and warn-only for DELETE edges:\n // - DELETE violations stay a warning: an edge that declares a DELETE cascade toward a child\n // missing its discovery or DELETE op needs a per-edge decision (add the op, retain, or drop\n // the cascade), and throwing would fail boot on any registry that has not made it yet. The\n // 16 billing edges once tracked as KNOWN_CASCADE_DELETABILITY_GAPS are resolved: the scope\n // edges are disabled and the billing-account edges declare REFUSE_WHILE_CHILDREN_EXIST.\n // - IMPERSONALIZE_AND_RETAIN violations have NO such backlog (no core edge declares the\n // strategy yet), and their runtime failure mode is far worse: the misconfiguration\n // surfaces only when a real erasure runs, throws INSIDE the parent-delete transaction\n // and rolls the deletion back — i.e. a GDPR erasure request fails in production. Catch\n // it at boot instead.\n // - REFUSE_WHILE_CHILDREN_EXIST violations (a child without READ) have no backlog either\n // (#1123), and at runtime every delete of the parent would fail CONFIGURATION on the\n // existence probe. The fix is one declaration, so boot names it.\n let cascadeDeletabilityViolations: CompositionCascadeDeletabilityViolation[] = [];\n try {\n cascadeDeletabilityViolations = validateCompositionCascadeDeletability(\n resourcesRegistry.resourceConfigurations as any,\n );\n } catch (error) {\n this.logger.warn('⚠️ composition-cascade-deletability guardrail skipped (validation error)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n const fatalCascadeViolations = cascadeDeletabilityViolations.filter(\n (violation) => violation.strategy !== ChildLifecycleStrategy.DELETE,\n );\n const deleteCascadeViolations = cascadeDeletabilityViolations.filter(\n (violation) => violation.strategy === ChildLifecycleStrategy.DELETE,\n );\n // ONE aggregated line for the known DELETE backlog — per-violation warnings would put ~16\n // lines in every boot log and train operators to ignore the channel.\n if (deleteCascadeViolations.length > 0) {\n // Report the EDGES, not a presumed cause. An earlier version asserted \"known backlog —\n // pending a retain-vs-delete compliance decision\", which is true only for the billing\n // families; a live run showed platform resources in the same list, where the cause is\n // simply a missing DELETE op. Stating one registry's story for every registry's\n // violations is how an operator learns to ignore the channel.\n const distinctEdges = [\n ...new Set(deleteCascadeViolations.map((v) => `${v.childResourceType} <- ${v.parentResourceType}`)),\n ];\n this.logger.warn(\n `⚠️ [composition-cascade-deletability] ${distinctEdges.length} onParentDelete edge(s) declare a DELETE ` +\n `cascade toward a child that cannot be cascade-deleted (missing discovery and/or DELETE op). Deleting ` +\n `such a parent throws CONFIGURATION inside its delete transaction and ROLLS BACK the parent delete, ` +\n `once a child row exists. Each edge needs a decision: add the missing op(s), retain the children ` +\n `(disable the cascade, or use strategy IMPERSONALIZE_AND_RETAIN with a retention-governed child), or ` +\n `drop onParentDelete.`,\n {\n edges: distinctEdges,\n // Surfaced because a duplicated pair means the SAME relationship is registered twice\n // for that child — a registry-assembly problem, not a cascade problem.\n duplicatedEdgeReports: deleteCascadeViolations.length - distinctEdges.length,\n },\n );\n }\n for (const violation of fatalCascadeViolations) {\n this.logger.warn(`⚠️ [composition-cascade-deletability] ${violation.message}`, {\n childResourceType: violation.childResourceType,\n parentResourceType: violation.parentResourceType,\n strategy: violation.strategy,\n });\n }\n if (fatalCascadeViolations.length > 0) {\n throw new Error(\n `Resource configuration error — ${fatalCascadeViolations.length} composition relationship(s) declared ` +\n `an onParentDelete strategy their child cannot honour (IMPERSONALIZE_AND_RETAIN or REFUSE_WHILE_CHILDREN_EXIST):\\n` +\n fatalCascadeViolations.map((violation) => ` • ${violation.message}`).join('\\n'),\n );\n }\n\n // --- Dependent-lifecycle CLASSIFICATION report (onParentDelete declared at all?) ---\n // The complement of the two guards above: they judge edges that OPTED IN to a lifecycle;\n // this reports the DEPENDENT edges that never opted either way. `onParentDelete.enabled`\n // defaults to false, so such an edge orphans its children on a plain parent delete AND on a\n // tenant purge (which dispatches the ordinary ORGANIZATIONS | DELETE and relies on the same\n // cascade), and a subject erasure reaching it is refused. Nothing reported the first two\n // until #1095 found a todo-list delete leaving its todos behind.\n //\n // WARN-only, ONE aggregated line, never a throw: an undeclared edge is a missing declaration\n // (each needs a per-edge decision — delete, retain scrubbed, or survive intact), and a\n // refusal here would fail boot on every application that has not made those decisions yet.\n // The classifier is the erasure runtime's own (`classifySubjectErasureDisposition`), so this\n // line names exactly the edges an erasure would refuse on.\n let unclassifiedLifecycleEdges: ReturnType<typeof collectUnclassifiedDependentLifecycleEdges> = [];\n try {\n unclassifiedLifecycleEdges = collectUnclassifiedDependentLifecycleEdges(\n resourcesRegistry.resourceConfigurations as any,\n );\n } catch (error) {\n this.logger.warn('⚠️ dependent-lifecycle-classification report skipped (validation error)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n if (unclassifiedLifecycleEdges.length > 0) {\n this.logger.warn(\n `⚠️ [dependent-lifecycle-unclassified] ${unclassifiedLifecycleEdges.length} DEPENDENT (COMPOSITION) edge(s) ` +\n `declare no usable onParentDelete lifecycle. Deleting such a parent leaves its children in place under a ` +\n `parent that no longer exists, a tenant purge leaves the same rows behind, and a subject erasure reaching ` +\n `the edge is refused. Each edge needs a declaration on the relationship: ` +\n `onParentDelete { enabled: true } (strategy DELETE, or IMPERSONALIZE_AND_RETAIN for a retention-governed ` +\n `child), or { enabled: false } to state that the rows survive their parent intact.`,\n {\n edges: unclassifiedLifecycleEdges.map((edge) =>\n `${edge.childResourceType} <- ${edge.parentResourceType}` +\n `${edge.foreignKeyField ? ` (${edge.foreignKeyField})` : ''} [${edge.disposition}]`),\n },\n );\n }\n\n // --- Composition seed op-path resolvability guard (onParentCreate lifecycle) ---\n // Complements the saas-models seedability guard above. That one verifies the\n // child's CREATE *DTO* is fillable; it cannot see whether the seed's SERVICE\n // op-path resolves — a backend-only concern. At seed time `createAsSystem`\n // resolves the child's default CREATE op via `getServiceOperationPathDefault`,\n // which accepts ONLY INTERNAL_CALL / API_CALL / API_CALL_WITH_CALLBACK — a\n // REPOSITORY_ONLY (or absent) default CREATE throws OPERATION_PATH_NOT_FOUND and\n // the runtime seed silently no-ops (the exact bug runtime-verify caught on the\n // first org/state adopters). Catch that class at boot, fail-closed, by reusing\n // the very resolver the seed uses (config-only, so callable here). Feature-gated\n // children are legitimately absent from the registry (the runtime seed skips\n // them the same way via `tryGetResourceConfiguration`) → they must not fail boot.\n const compositionSeedOpPathViolations: string[] = [];\n for (const childConfig of Object.values(\n resourcesRegistry.resourceConfigurations,\n ) as unknown as CompositionSeedabilityResourceInput[]) {\n const childResourceType = childConfig.resourceIdentifier;\n const parentRelationships: ResourceRelationship[] = childConfig.resourceRelationships?.parentRelationships ?? [];\n for (const relationship of parentRelationships) {\n if (relationship.nature !== RelationshipNature.COMPOSITION) continue;\n if (relationship.childOperations?.lifecycle?.onParentCreate?.enabled !== true) continue;\n // Feature-excluded child → absent from the registry → the runtime seed\n // skips it (same `tryGetResourceConfiguration` check), so don't fail boot.\n if (!this.resourcesRegistryService.tryGetResourceConfiguration(childResourceType)) continue;\n try {\n this.resourcesRegistryService.getServiceOperationPathDefault(\n childResourceType,\n CoreResourceOperation.CREATE,\n );\n } catch {\n compositionSeedOpPathViolations.push(\n `Composition child '${childResourceType}' (parent '${relationship.resourceType1}') enabled ` +\n `onParentCreate but createAsSystem cannot resolve a default CREATE service op-path — typically a ` +\n `REPOSITORY_ONLY or absent default CREATE variant (the service tier accepts only INTERNAL_CALL / ` +\n `API_CALL). The runtime seed would silently no-op. Make the default CREATE variant INTERNAL_CALL.`,\n );\n }\n }\n }\n if (compositionSeedOpPathViolations.length > 0) {\n throw new Error(\n `Resource configuration error — ${compositionSeedOpPathViolations.length} composition relationship(s) enabled ` +\n `onParentCreate seeding but their child has no service-resolvable default CREATE op:\\n` +\n compositionSeedOpPathViolations.map((message) => ` • ${message}`).join('\\n'),\n );\n }\n\n const resourceConfigurations = new Map(\n Object.entries(resourcesRegistry.resourceConfigurations) as [ResourceType, ResourceConfiguration<any, any, any>][]\n );\n\n if (platformPersistenceAdapter !== undefined && !isPlatformApplication) {\n throw new Error(\n 'platformPersistenceAdapter is a PLATFORM-MODE parameter. An application declares its '\n + 'persistence adapter in application config (DATABASE_DEFAULT_ADAPTER); accepting it here '\n + 'would smuggle the decision past that contract.',\n );\n }\n if (platformPersistenceAdapter !== undefined) {\n // BEFORE initializeRepositories, necessarily: this is the construction-time answer.\n this.repositoriesRegistryService.setPlatformModeDefaultPersistenceAdapter(platformPersistenceAdapter);\n }\n\n // Initialize repositories registry on the active default connection\n const activeConnection = this.mongoDBService.getConnection();\n await this.repositoriesRegistryService.initializeRepositories(resourceConfigurations, activeConnection || undefined);\n this.logDebug('✅ Repositories registry initialized successfully');\n\n // PostgreSQL DDL is owned OUTSIDE the engine (the schema planner plans; migrations apply),\n // so a PostgreSQL-backed table can silently disagree with what the repository writes — most\n // sharply for framework-owned columns no app schema declares. Prove the physical tables\n // match the plan HERE, once, rather than letting the first request fail on a bare\n // `column \"...\" does not exist`. Deliberately after `initializeRepositories` (the plans must\n // exist) and outside it (the PostgreSQL connection is lazy and need not be reachable while\n // repositories are being constructed). No-op unless a resource is PostgreSQL-backed, so it\n // never forces a connection an application does not use.\n // THE PRODUCTION MIGRATION DOOR (K7), deliberately immediately BEFORE the schema gate:\n // the runner brings the database to the shipped migrations' state, then the gate verifies\n // the result — so the gate stays the backstop even for the runner itself (K6). Both\n // no-op unless a resource is PostgreSQL-backed, and the runner additionally no-ops when\n // the deployable ships no migrations directory. Concurrency (N instances booting at\n // once) is the runner's own property via the in-database advisory lock.\n //\n // PLATFORM MODE DEFERS BOTH (Phase 5.2): the AppConfigurationService a platform service\n // hydrates AFTER this method cannot answer connection questions here, and this shared\n // body must not read it (the 2026-08-02 incident class, platform/CLAUDE.md). Platform\n // startups invoke `applyStartupPostgresMigrations()` + `verifyPostgreSqlTableSchemas()`\n // themselves — apps-manager immediately after this method returns (its Phase 2.5,\n // BEFORE its first repository read, with the connection supplied by the Phase-1\n // `connectWithUrl` pre-connect door rather than by hydration — Phase 5.3);\n // module-registry in its platform-owner phase, post-hydration.\n if (!isPlatformApplication) {\n this.logDebug('🚚 Applying startup PostgreSQL migrations (if any)...');\n await this.repositoriesRegistryService.applyStartupPostgresMigrations();\n\n this.logDebug('🧮 Verifying PostgreSQL physical table schemas...');\n await this.repositoriesRegistryService.verifyPostgreSqlTableSchemas();\n this.logDebug('✅ PostgreSQL physical table schemas verified');\n }\n\n // Preserve the historical post-repository factory lifecycle:\n // custom factories may resolve repository-backed services while\n // materializing their registrations.\n this.customImplRegistry.initialize([\n ...CoreBackend_ServiceImplementationsFactories,\n ...customServiceImplementations,\n ]);\n\n if (applicationConfig) {\n // Runtime-contract validation needs both the populated email\n // template registry and the finalized `transactionalCore`\n // registrations. It still runs before service/controller\n // initialization, so no operation can accept traffic first.\n this.logDebug('🧭 Validating initialized runtime contracts...');\n this.applicationStartupConfigValidator.validateInitializedRuntimeContracts(applicationConfig);\n // RAG store capability probe (fail-closed) — async because it EXECUTES a pgvector\n // expression on the live connection; no-op for applications with no `.ragSource()`\n // fields, so it never forces a database connection an application does not use.\n await this.applicationStartupConfigValidator.validateInitializedRagStoreCapability();\n // #1613: how many live rows the CURRENT retention schedule already puts past their period,\n // so a shortened period is visible before the retention-class sweep's next run. Never fatal.\n // Only in the runtime that enforces the classes: a confined runtime has no grant to count.\n if (bootAssertions.enforcesRetentionClasses) {\n const retentionConfigurations = this.resourcesRegistryService.getResourceTypes()\n .map((resourceType) => this.resourcesRegistryService.getResourceConfiguration(resourceType));\n await reportRetentionClassPositionsAtStartup({\n configurations: retentionConfigurations as never,\n allConfigurations: retentionConfigurations as never,\n schedule: applicationConfig.compliance?.dataRetention,\n repositoriesRegistry: this.repositoriesRegistryService,\n logger: this.logger,\n });\n }\n if (bootAssertions.assertsPersistenceTransactionReadiness) {\n await this.applicationStartupConfigValidator\n .validateInitializedRuntimeTransactionReadiness(\n applicationConfig,\n );\n } else {\n this.logDebug(\n '🧭 Skipping persistence transaction-readiness proof: this runtime does not own it '\n + '(ApplicationRuntimeProfileBootAssertions.assertsPersistenceTransactionReadiness). '\n + 'The probe touches a synthetic collection no resourceAccess declares, and proves a '\n + 'deployment-wide property the application backend already proves.',\n );\n }\n this.logDebug('✅ Initialized runtime contracts validated successfully');\n }\n\n // Step 4: Initialize services registry (business logic layer)\n this.logDebug('🏢 Initializing services registry...');\n await this.servicesRegistryService.initializeServices();\n\n // Step 4.0.5: Type every existing organization whose type resolves to nothing — none stored, or one the\n // configuration no longer declares — or refuse to start (#1032, #1036).\n //\n // After `initializeServices` because each assignment is recorded through the audit service, and before\n // anything below can read an organization — cascade observers, queue consumers, seeds, the owner-floor\n // report, the HTTP listener. The sign-in resolver refuses members of such an organization, so a\n // deployment holding one would otherwise start healthy with those members locked out.\n //\n // Platform services run the same step themselves once their migrations have applied (apps-manager's\n // Phase 2.5), against the platform's own declared types: this shared body does not know them. A confined\n // runtime skips it for the reason every maintenance step does — it holds no write on `organizations`\n // and is not accountable for the population.\n if (!isPlatformApplication && bootAssertions.performsBootSchemaMaintenance) {\n await assignDerivableOrganizationTypesAtBoot({\n repositoriesRegistry: this.repositoriesRegistryService,\n organizationTypes: applicationConfig?.organizationTypes,\n errorBuilder: this.errorBuilder,\n logger: this.logger,\n recordAssignment: async (assignment) => {\n if (!this.auditLogsService) {\n throw new Error('the audit logs service is not bound in this runtime');\n }\n // The application classifying its own tenants at boot — nobody asked (#1595).\n await this.auditLogsService.logOrganizationTypeAssigned(assignment, undefined, SYSTEM_AUDIT_PRINCIPAL);\n },\n });\n }\n\n // Step 4.1: Cascade-tier evidence observers (#365).\n //\n // Registered HERE — on the registry `initializeServices` just built, BEFORE any runtime\n // decorator below replaces `this.servicesRegistryService` — and that ordering is the\n // point. The cascade reads observers through the `servicesRegistry` each per-resource\n // service captured at construction, which is this undecorated instance. Registering on a\n // decorated wrapper would store the observer somewhere the cascade never looks, and\n // nothing would say so: the purge would still succeed and simply emit nothing.\n //\n // Unconditional: a tenant purge must leave per-credential evidence in every deployment.\n // An observer for a resource this runtime never registered is never dispatched, so the\n // minion and worker runtimes that share this startup pay nothing for it.\n if (container) {\n registerOrganizationProviderCredentialCascadeEvidence(this.servicesRegistryService, container);\n // A subject erasure's per-credential destruction record (#975): the same seam, the same\n // ordering constraint, and it emits only for a cascade that declares itself an erasure.\n registerUserProviderCredentialCascadeEvidence(this.servicesRegistryService, container);\n }\n\n if (servicesRegistryDecoratorFactory) {\n if (!applicationConfig) {\n throw new Error('servicesRegistryDecoratorFactory requires application configuration and cannot run during pre-hydration platform startup.');\n }\n this.servicesRegistryService = servicesRegistryDecoratorFactory(this.servicesRegistryService, {\n appConfig: applicationConfig,\n errorBuilder: this.errorBuilder,\n });\n this.rebindServicesRegistryForRuntime(container, this.servicesRegistryService);\n this.logDebug('✅ Runtime-specific services registry decorator installed');\n }\n this.logDebug('✅ Services registry initialized successfully');\n\n // Step 4.4: Supply the session revoker used when a subject erasure scrubs a person's row.\n //\n // Unconditional, unlike the billing effect below: an erased person's login must stop\n // working in every deployment, so this is a core privacy control rather than a\n // provider-tied one. Registered as a PORT rather than injected directly because\n // `AuthTokenIssuer` already depends on the services-registry handler, which is where the\n // scrub chokepoint that calls this lives — a direct dependency would close that cycle.\n if (container) {\n (container.get(SAAS_SERVICE_TYPES.SubjectSessionRevocationService) as SubjectSessionRevocationBackendService)\n .register(async (userId: string) => {\n await (container.get(SAAS_SERVICE_TYPES.AuthTokenIssuer) as AuthTokenIssuerBackendService)\n .invalidateAllTokensForUser(userId);\n });\n this.logDebug('🔒 Subject-erasure session revoker registered');\n }\n\n // Step 4.5: Initialize billing services (if enabled). Billing's provider-event handler is returned,\n // not registered here: it joins the application's handlers in the FATAL registration step below (#1629).\n let billingInboundHandler: AnyInboundHandlerDefinition | null = null;\n if (applicationConfig?.billing?.enabled && container) {\n billingInboundHandler = await this.initializeBillingServices(container, applicationConfig.billing, productDefinitions);\n }\n\n // Step 4.55: Register inbound handlers (#1596). FATAL on purpose and outside every non-fatal\n // catch: a misdeclared handler is a code defect, and a warning would leave a sender retrying into\n // a 404 while the process looks healthy. After billing (Step 4.5), because a provider endpoint may\n // be owned by either a capability handler or an inbound handler, and never by both.\n if (!isPlatformApplication && container) {\n this.registerInboundHandlers(container, billingInboundHandler ? [...inboundHandlers, billingInboundHandler] : inboundHandlers);\n }\n\n // Step 4.6: Initialize webhook auto-controller (must happen before controllers registry)\n if (!isPlatformApplication && container) {\n await this.initializeWebhookAutoController(container);\n }\n\n // Step 5: Initialize controllers registry (HTTP endpoints layer)\n this.logDebug('🌐 Initializing controllers registry...');\n\n\n // Get manual controllers from provided container\n let allCustomControllers: AbstractControllerBackendService[] = [];\n\n if (container) {\n // G-4: SCIM controller mount is app-global — it mounts when ANY registered\n // org type opts into scimProvisioning (organizationTypes[t].scimProvisioning.enabled).\n // Per-org / per-token enforcement happens downstream once mounted (DIRECTORY_PROVISIONING\n // feature + the org-type scimProvisioning.enabled gate via isScimProvisioningEnabledForOrg).\n // Fail-closed: off unless a type opts in.\n const directoryProvisioningEnabled = isScimProvisioningEnabledForAnyOrgType(\n this.resourcesRegistryService.getOrganizationTypesConfig(),\n );\n const analyticsEnabled = !!applicationConfig?.analytics?.enabled;\n const manualControllers = isPlatformApplication ? [] : getManualControllersBackend(container, { directoryProvisioningEnabled, analyticsEnabled });\n allCustomControllers = [\n ...manualControllers,\n ...(customControllers || [])\n ];\n\n\n\n this.logDebug('📋 Controllers to register', {\n manualControllers: manualControllers.length,\n runtimeCustomControllers: customControllers?.length || 0,\n totalCustomControllers: allCustomControllers.length\n });\n } else {\n allCustomControllers = customControllers || [];\n\n this.logDebug('📋 Controllers to register', {\n manualControllers: 0,\n runtimeCustomControllers: customControllers?.length || 0,\n totalCustomControllers: allCustomControllers.length\n });\n }\n if(!isPlatformApplication) {\n await this.controllersRegistryService.initialize(\n allCustomControllers.length > 0 ? allCustomControllers : undefined,\n controllerWhiteList\n );\n this.logDebug('✅ Controllers registry initialized successfully');\n } else {\n this.logDebug('Skipping controllers registry initialization in platform mode (will be started by apps-manager)');\n }\n\n // Step 5.5: Initialize batches/cronjobs (core engine + custom + resource-based)\n this.logDebug('🧵 Initializing batches & cronjobs...');\n const customBatches = customBatchesFactory\n ? customBatchesFactory({\n logger: this.logger,\n errorBuilder: this.errorBuilder,\n errorHandler: this.errorHandler,\n executionContextCreatorService: this.executionContextCreatorBackendService,\n resourcesRegistryService: this.resourcesRegistryService,\n repositoriesRegistryService: this.repositoriesRegistryService,\n servicesRegistryService: this.servicesRegistryService,\n })\n : new Map<string, BatchesCronjobsCustomExecution_Service<any, any>>();\n\n // Register core engine batches (always present, independent of custom app)\n customBatches.set(FILES_CLEANUP_BATCH_REF, createFilesCleanupBatch());\n // Hourly RAG reconciliation sweep (plan §3.c backstop, DL1). Registered UNCONDITIONALLY,\n // like files-cleanup: on an application with no `.ragSource()` fields it finds zero\n // resource types and zero chunk sets and costs one enumeration — a better trade than\n // corpus convergence silently depending on a registration condition. It is also the\n // bound every chunk-tier log-never-throw seam cites, so it must exist wherever they do.\n customBatches.set(RAG_RECONCILIATION_SWEEP_BATCH_REF, createRagReconciliationSweepBatch());\n // Five-minute RAG embedding drain (plan §3.d, Phase 4): fills the NULL-vector ledger\n // the sweep counts, and re-embeds on class→model binding moves. Registered\n // UNCONDITIONALLY for the sweep's reason — an app with no `.ragSource()` fields\n // returns after one detection walk; a RAG app with no embeddings provider gets a\n // visible missing-provider WARN instead of a silently frozen backlog.\n customBatches.set(RAG_EMBEDDING_DRAIN_BATCH_REF, createRagEmbeddingDrainBatch());\n customBatches.set(CONSUMABLE_TOKENS_CLEANUP_BATCH_REF, createConsumableTokensCleanupBatch());\n // Daily retention for the deferred-onboarding ledger (#1131). Registered UNCONDITIONALLY, like the token\n // cleanup beside it: an application that never defers onboarding has no rows and returns after one delete.\n customBatches.set(ORGANIZATION_ONBOARDING_OPERATIONS_CLEANUP_BATCH_REF, createOrganizationOnboardingOperationsCleanupBatch());\n // Hourly retention for the system-of-record write admissions (#1679). Registered UNCONDITIONALLY for the same\n // reason: an application that writes no read-through row has no admissions and returns after one delete.\n customBatches.set(SYSTEM_OF_RECORD_WRITE_ADMISSIONS_CLEANUP_BATCH_REF, createSystemOfRecordWriteAdmissionsCleanupBatch());\n customBatches.set(A2A_ABANDONED_TASK_SWEEP_BATCH_REF, createA2AAbandonedTaskSweepBatch());\n // Every minute: fails an approval pause nobody answered inside its window (#484; per-gate lapses since #1628). Registered\n // UNCONDITIONALLY, like the abandoned-task sweep beside it — an application with no agent\n // turn awaiting a person lists nothing and returns. Correctness does not wait on it (a late\n // decision is refused at use); the RECORD does, or an unanswered pause reads as live forever.\n customBatches.set(APPROVAL_PAUSE_EXPIRY_SWEEP_BATCH_REF, createApprovalPauseExpirySweepBatch());\n // Every minute: fires pending decisions' CLAIM and DECISION deadline stages (#1628). Registered\n // UNCONDITIONALLY: every gate gets default reminders, and a run with nothing due lists nothing.\n customBatches.set(DECISION_DEADLINE_SWEEP_BATCH_REF, createDecisionDeadlineSweepBatch());\n // Every five minutes: fails a conversational turn whose process died mid-turn, from its liveness\n // lease (#1780). Registered UNCONDITIONALLY, like the two sweeps above: an application with no turn\n // running lists nothing, and one with no Redis abstains, because there no lease can be trusted.\n customBatches.set(INTERRUPTED_TURN_SWEEP_BATCH_REF, createInterruptedTurnSweepBatch());\n // Every declared autonomous agent that carries a `schedule` (#1611), from the one declaration — no\n // second list. A ref the application's own factory already registered is a defect, not an override.\n for (const declaration of this.flowsActorsRegistryService.getAutonomousAgents()) {\n if (!declaration.schedule) continue;\n const batchRef = autonomousAgentScheduleBatchRef(declaration.ref);\n if (customBatches.has(batchRef)) {\n throw new Error(`Autonomous agent \"${declaration.ref}\" declares a schedule, and the application also registers batch \"${batchRef}\" itself; declare it in one place.`);\n }\n customBatches.set(batchRef, createAutonomousAgentScheduleBatch(declaration.ref, declaration.schedule));\n }\n // Daily hygiene sweep for the invitation→membership-junction model: prunes\n // long-stale INVITED rows + orphan PENDING_INVITATION users. Always present\n // (invitations are a core org capability, not a feature-gated add-on).\n customBatches.set(ORGANIZATION_MEMBER_INVITATION_SWEEP_BATCH_REF, createOrganizationMemberInvitationSweepBatch());\n // Hourly sweep that lifts EXPIRED time-boxed suspensions. Registered UNCONDITIONALLY:\n // `organizationMembers | suspend` and `users | suspend_user` both accept a window and\n // persist the resolved instant, so an application without this batch records \"for seven\n // days\" and suspends forever. Unlike the invitation sweep above, correctness does NOT\n // hold without it — the batch is what makes the declared contract true.\n customBatches.set(SUSPENSION_REACTIVATION_SWEEP_BATCH_REF, createSuspensionReactivationSweepBatch());\n /*\n * Nightly relabelling of elapsed machine credentials and platform access grants.\n * Registered UNCONDITIONALLY, but for a DIFFERENT reason from the sweep above it, and\n * the difference is worth keeping straight: correctness does NOT depend on this one.\n * Every guard already compares `expiresAt` against now, so an elapsed credential is\n * refused whether or not this batch runs. What depends on it is the RECORD — without it\n * `EXPIRED` has no producer at all, and a listing of API keys, OAuth clients or access\n * grants shows elapsed ones as ACTIVE forever (#413).\n */\n customBatches.set(CREDENTIAL_EXPIRY_SWEEP_BATCH_REF, createCredentialExpirySweepBatch());\n /*\n * The scheduled flush that makes a METERED product bill (#415). Registered CONDITIONALLY,\n * unlike the two above it, because it is the one batch here whose work is meaningless\n * without a configured provider: `flushToProvider` returns \"Provider not initialized\" on\n * every tick, which would put an error line in the log of every application that has no\n * billing every five minutes forever. A diagnostic that always fires is one operators stop\n * reading, and this batch's errors are the ones that say whose money went unbilled.\n *\n * The condition is the same `billing.enabled` the provider bootstrap below keys on, so the\n * batch exists exactly when the service it calls has been initialized.\n */\n if (applicationConfig?.billing?.enabled) {\n customBatches.set(USAGE_FLUSH_BATCH_REF, createUsageFlushBatch());\n /*\n * The scheduled reconciliation that makes a LOST webhook recoverable. Gated on the\n * same `billing.enabled` as the flush above it, and for the same reason: without a\n * provider it would report \"Provider not initialized\" every hour forever in every\n * application that has no billing, and a diagnostic that always fires is one nobody\n * reads — which matters most here, because this batch's findings are the ones that\n * say a customer's entitlements were wrong.\n */\n customBatches.set(BILLING_RECONCILIATION_BATCH_REF, createBillingReconciliationBatch());\n /*\n * The relay that DELIVERS what committed billing changes owe (#535): audit rows, feature\n * recomputation, notifications. Same `billing.enabled` gate: only billing writes the outbox, so\n * without billing every tick would find nothing, and the relay's consumers need the billing services.\n */\n customBatches.set(BILLING_EFFECT_OUTBOX_RELAY_BATCH_REF, createBillingEffectOutboxRelayBatch());\n /*\n * Recovery of subscription mutations whose provider outcome is unknown (#535 S7a): a held slot blocks every other\n * mutation of its subscription until this settles it. Same gate: only billing admits mutations.\n */\n customBatches.set(BILLING_SUBSCRIPTION_MUTATION_RECOVERY_BATCH_REF, createBillingSubscriptionMutationRecoveryBatch());\n }\n /**\n * Retention sweeps, one per engine `.ttl()` resource. Registered UNCONDITIONALLY, like the\n * suspension sweep above and for the same reason: without them the declared contract is\n * simply untrue on PostgreSQL, which has no native TTL. On MongoDB the TTL index also\n * expires these rows — the sweep then finds nothing and costs one cheap query, which is\n * a better trade than retention silently depending on which store an app happens to use.\n */\n customBatches.set(\n JOB_EXECUTIONS_RETENTION_SWEEP_BATCH_REF,\n createResourceRetentionSweepBatch(\n CoreResourceType.JOB_EXECUTIONS as ResourceType,\n ENGINE_JOB_EXECUTIONS_RETENTION_SWEEP_MANIFEST,\n ),\n );\n customBatches.set(\n JOB_PAYLOAD_STORAGE_RETENTION_SWEEP_BATCH_REF,\n createResourceRetentionSweepBatch(\n CoreResourceType.JOB_PAYLOAD_STORAGE as ResourceType,\n ENGINE_JOB_PAYLOAD_STORAGE_RETENTION_SWEEP_MANIFEST,\n ),\n );\n // #1613: the retention-class sweep — deletes every class-bound row whose declared period has ended,\n // through the service layer, on both adapters. Registered for EVERY application (like the `.ttl()`\n // sweeps): one that binds nothing finds zero resources and costs one registry walk, and a period the\n // privacy notice states must never depend on an application opting in. Two gates, both about WHERE:\n // - `applicationConfig` — a platform service registers the engine resources but holds no retention\n // schedule, so the sweep would find every class undeclared and delete nothing. Six bound engine\n // resources have platform tables: `providerCallRecords`, the two inbound-delivery resources and the\n // three service-provider resources. Measured 2026-09-25 for `providerCallRecords` only: no platform\n // service invokes an agent, so that table stays empty. The other five are written by application\n // tenant flows (inbound webhooks, service-provider relationships) that no platform service serves;\n // not separately measured. A platform service that starts writing any of them owes a schedule and\n // this registration.\n // - `enforcesRetentionClasses` — only the application backend: a minion's table-scoped role can\n // neither read nor delete the bound resources.\n if (applicationConfig && bootAssertions.enforcesRetentionClasses) {\n customBatches.set(RETENTION_CLASS_SWEEP_BATCH_REF, createRetentionClassSweepBatch());\n // #1598: the model-cost period close — the same runtime and the same reason: only the application\n // backend holds the tenants' detail rows and may write their aggregates.\n customBatches.set(MODEL_COST_PERIOD_CLOSE_BATCH_REF, createModelCostPeriodCloseBatch(applicationConfig.modelCostAccounting?.periodCloseCronSchedule));\n }\n // WS-A tenant teardown — destroys tenants whose retention window has elapsed.\n // Registered UNCONDITIONALLY (no feature gate) for real applications: `request_deletion`\n // is always reachable, so a tenant can always end up marked, and an application without\n // this batch would accumulate marked-but-never-destroyed tenants forever — the exact\n // failure a retention window exists to prevent. Every field of `tenantTeardown` defaults,\n // so an app that declares no block still purges on a 30-day window.\n //\n // Skipped for `isPlatformApplication`: platform services (apps-manager, crontabs-batches-\n // manager, ...) have no ORGANIZATIONS to tear down, and `applicationConfig` is\n // not yet populated at this point in a platform application's boot — it resolves config\n // in its own later phase, AFTER this `super.initialize()` call returns — so reading it here\n // unconditionally threw `app_configuration_not_initialized` at platform-apps-manager boot.\n if (applicationConfig) {\n customBatches.set(ORGANIZATION_PURGE_BATCH_REF, createOrganizationPurgeBatch(applicationConfig.tenantTeardown));\n }\n // Event-triggered (enqueued by the notifications dispatcher, no cron).\n // Registered unconditionally so any email notification enqueued onto\n // the custom-batch queue can resolve its executor.\n // Deferred child-lifecycle teardown (#427) — enqueued by\n // `ServiceResourceBackendService.queueChildDeletion` when a relationship declares\n // `ChildLifecycleMode.LAZY`, no cron. Registered UNCONDITIONALLY for exactly the reason\n // the email and webhook drains are: a job whose ref does not resolve hits\n // `JOB_BATCH_REF_NOT_FOUND` and is silently dead-lettered — and here that would mean a\n // child teardown that the parent delete already reported as done.\n customBatches.set(CHILD_LIFECYCLE_TEARDOWN_BATCH_REF, createChildLifecycleTeardownBatch());\n customBatches.set(EMAIL_BATCH_SEND_BATCH_REF, emailBatchSendService);\n // Event-triggered M2M outbound webhook delivery (enqueued by\n // `M2MWebhookDispatcherBackendService.enqueueDelivery`, no cron) and\n // SIEM webhook delivery (enqueued by\n // `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`, no\n // cron). Both are registered unconditionally for the SAME reason as\n // email: the dispatchers gate enqueue per-org/per-endpoint, so the\n // drains MUST always resolve — else an enqueued job hits\n // `JOB_BATCH_REF_NOT_FOUND` and is silently dead-lettered.\n customBatches.set(M2M_WEBHOOK_DELIVERY_BATCH_REF, m2mWebhookDeliveryBatchService);\n // Inbound deliveries (#1596): the dispatch drain and its sweep, unconditionally — an enqueued\n // dispatch with no registered batch would be dead-lettered, and the sweep is what re-drives a\n // delivery whose job was lost.\n customBatches.set(INBOUND_DELIVERY_DISPATCH_BATCH_REF, inboundDeliveryDispatchBatchService);\n customBatches.set(INBOUND_DELIVERY_SWEEP_BATCH_REF, inboundDeliverySweepBatchService);\n // Replies on inbound channels (#1630): the send drain and its sweep, unconditionally for the same reason.\n customBatches.set(INBOUND_REPLY_SEND_BATCH_REF, inboundReplySendBatchService);\n customBatches.set(INBOUND_REPLY_SWEEP_BATCH_REF, inboundReplySweepBatchService);\n // #1600: the email-domain re-check (a no-op when the application receives no email).\n customBatches.set(EMAIL_DOMAIN_RECHECK_BATCH_REF, emailDomainRecheckBatchService);\n customBatches.set(SIEM_WEBHOOK_DELIVERY_BATCH_REF, siemWebhookDeliveryBatchService);\n // The SIEM batching collector (#1379), scheduled by the delivery worker when a\n // destination batches. Registered unconditionally for the same reason as the drain it\n // partners: whether a flush job is ever enqueued is a per-destination CONFIG decision\n // (`delivery.batchSize > 1`), so the ref must always resolve or an operator enabling\n // batching would silently dead-letter every flush and their events would sit pending.\n customBatches.set(SIEM_DELIVERY_FLUSH_BATCH_REF, siemDeliveryFlushBatchService);\n // A2A push-notification delivery (enqueued by `A2APushDispatcherBackendService` on a\n // task transition, no cron). Registered unconditionally for the same reason as its two\n // siblings above: the dispatcher gates enqueue per registered webhook, so the drain\n // MUST always resolve — an enqueued job that hits `JOB_BATCH_REF_NOT_FOUND` is silently\n // dead-lettered, which for a notification means the client is never told and nothing\n // says so.\n customBatches.set(A2A_PUSH_DELIVERY_BATCH_REF, a2aPushDeliveryBatchService);\n // Audit Phase 3 — cron completeness reconciler. Registered unconditionally\n // (like the sibling delivery drains) so a mis-set global flag can't orphan the\n // schedule; it no-ops cleanly when no reconcilable audit sink is declared.\n customBatches.set(IMMUDB_AUDIT_RECONCILE_BATCH_REF, immudbAuditReconcileBatchService);\n // Audit Phase 5 / F1 — cron audit-log ARCHIVAL. Registered\n // unconditionally (like the reconcile batch); it no-ops cleanly at\n // tick time when no horizon resolves (neither `auditTrail.archiveAfterDays`\n // nor the declared `dataRetention[AUDIT_LOGS]` period, #1613) or\n // no file-storage provider is configured. Never deletes (AUDIT_LOGS\n // is immutable, G5) — it copies aged rows to durable archival\n // artifacts.\n customBatches.set(AUDIT_LOGS_ARCHIVE_BATCH_REF, auditLogsArchiveBatchService);\n\n if (applicationConfig && this.appConfigService.anonymousSessionsEnabled) {\n customBatches.set(ANONYMOUS_SESSION_CLEANUP_BATCH_REF, createAnonymousSessionCleanupBatch());\n this.logDebug('✅ Anonymous session cleanup batch registered');\n }\n\n // Register lifecycle dormancy detection batch (only when lifecycle is enabled)\n if (lifecycleConfig?.enabled) {\n customBatches.set(DORMANCY_DETECTION_BATCH_REF, createDormancyDetectionBatch(lifecycleConfig.dormancyCronSchedule));\n this.logDebug('✅ Dormancy detection batch registered', { cronSchedule: lifecycleConfig.dormancyCronSchedule });\n }\n\n // Register data-seeding scheduled-rerun batch (Phase 7 / Item 47, Slice 5).\n //\n // Gate: at least one passed `dataSeeds` entry declares a `schedule?:`\n // block. We pre-filter the in-memory definitions array (rather than\n // querying the registry, which is hydrated later in Step 7) so apps\n // without any cron-opted-in seeds don't spawn a minute-tick cron that\n // would always no-op. Platform mode bypasses entirely (no per-tenant\n // data seeds run on the platform process).\n if (applicationConfig) {\n const hasScheduledSeeds = (dataSeeds ?? []).some((seed) => seed.schedule !== undefined);\n if (hasScheduledSeeds) {\n // Fallback ladder is flat by design: the Zod schema\n // applies `DATA_SEEDING_SCHEDULED_RERUN_DEFAULT_CRON`\n // as a default when `dataSeeding.scheduledRerunCronSchedule`\n // is missing but the `dataSeeding` block is present;\n // when the whole block is absent, we short-circuit to\n // the shared constant. Both branches land on the SAME\n // literal, so there's a single source of truth — no\n // `?? manifest.cronExpression ?? '* * * * *'` tail.\n const dataSeedingConfig = applicationConfig.dataSeeding;\n const cronSchedule = dataSeedingConfig?.scheduledRerunCronSchedule\n ?? DATA_SEEDING_SCHEDULED_RERUN_DEFAULT_CRON;\n customBatches.set(\n DATA_SEEDING_SCHEDULED_RERUN_BATCH_REF,\n createDataSeedingScheduledRerunBatch(cronSchedule),\n );\n this.logDebug('✅ Data-seeding scheduled-rerun batch registered', { cronSchedule });\n }\n\n // Register the ETL pipeline scheduled-run batch (partial-resource paper, PR-12).\n //\n // Gate: at least one registered resource declares `externalDataPipeline.scheduleCron` — the\n // resources registry is initialized in an earlier step, so we query it directly.\n // Apps with no scheduled pipelines don't spawn a minute-tick cron that would\n // always no-op; on-demand pipelines (no `scheduleCron`) run only through the\n // run service's imperative door. Same platform-mode bypass as the sibling above.\n const hasScheduledEtlPipelines = this.resourcesRegistryService\n .getResourceTypes()\n .some((resourceType) => {\n const configuration = this.resourcesRegistryService.getResourceConfiguration(resourceType) as {\n externalDataPipeline?: { scheduleCron?: string };\n };\n return configuration?.externalDataPipeline?.scheduleCron !== undefined;\n });\n if (hasScheduledEtlPipelines) {\n customBatches.set(\n EXTERNAL_DATA_PIPELINE_SCHEDULED_RUN_BATCH_REF,\n createExternalDataPipelineScheduledRunBatch(),\n );\n this.logDebug('✅ ETL pipeline scheduled-run batch registered');\n }\n\n // Register data-seeding run-cleanup batch (audit L4-10,\n // post-Phase-7 close-out). Daily retention sweep that prunes\n // terminal `DataSeedRun` rows older than\n // `DataSeedingConfig.runRetentionDays` (default 30) while\n // preserving the MAX(seedVersion) row per business-key group\n // (so dispatcher idempotency is never broken).\n //\n // Gate: any registered seeds (regardless of `schedule?:`).\n // Apps with no seeds produce no `DataSeedRun` rows so the\n // sweep would always no-op. Platform mode bypasses (no\n // per-tenant data seeds run on the platform process).\n //\n // Retention is read at TICK time from app config (NOT at\n // registration), so an in-place config change takes effect\n // on the next daily tick without redeploy — see the\n // manifest's JSDoc and `resolveRetentionDays()` in the\n // batch body.\n const hasAnySeeds = (dataSeeds ?? []).length > 0;\n if (hasAnySeeds) {\n customBatches.set(\n DATA_SEEDING_RUN_CLEANUP_BATCH_REF,\n createDataSeedingRunCleanupBatch(),\n );\n this.logDebug('✅ Data-seeding run-cleanup batch registered');\n }\n }\n\n await this.batchesExecutor.initialize(customBatches);\n this.logDebug('✅ Batches & cronjobs initialized');\n\n // Step 5.9: Wire the data-seed declarations — registry, scope resolvers, Level-B resource-lifecycle\n // hooks, LAZY guards — BEFORE the HTTP server listens. A request that reaches the services registry\n // before these exist runs without its seeds, and a missed `afterCreate` is never retried. The\n // application-lifecycle passes stay at Step 7.7. See `wireDataSeedingDeclarations`.\n this.wireDataSeedingStep(dataSeeds, dataSeedScopeResolvers, runtimeProfile);\n\n // Step 6: Initialize HTTP server (skip here in platform mode or headless runtimes)\n if (this.shouldInitializeHttpServer({ headlessMode })) {\n // Register operator-facing admin controllers BEFORE HTTP init so they get\n // mounted at their custom root paths (e.g. /internal/admin/data-seeding)\n // by registerRoutes(). They MUST go through registerCustomController(), not\n // through getManualControllersBackend(), because the manual-controllers list\n // is mounted under /api/v1 by the controllers registry — root-level admin\n // surfaces (mirroring /health) must skip that prefix.\n if (container) {\n try {\n const dataSeedingAdminController = container.get(\n SAAS_SERVICE_TYPES.DataSeedingAdminController,\n ) as DataSeedingAdminBackendController;\n this.httpServerService.registerCustomController(dataSeedingAdminController);\n this.logDebug('🌱 Data-seeding admin controller registered for root mount');\n\n // The external-data operator door (list pipelines + run one now). Same\n // root-mount reasoning, and registered beside its sibling so a future\n // reader finds every /internal admin surface in one place.\n const externalDataAdminController = container.get(\n SAAS_SERVICE_TYPES.ExternalDataAdminController,\n ) as ExternalDataAdminBackendController;\n this.httpServerService.registerCustomController(externalDataAdminController);\n this.logDebug('🔌 External-data admin controller registered for root mount');\n } catch (error) {\n this.logger.warn('⚠️ Failed to register DataSeedingAdminController; admin endpoints will be unavailable', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n this.logger.info('🌍 Initializing HTTP server...');\n await this.httpServerService.initialize();\n this.logger.info('✅ HTTP server initialized successfully');\n } else if (this.isPlatformMode) {\n this.logDebug('Skipping HTTP server initialization in platform mode (will be started by apps-manager)');\n } else {\n this.logDebug('Skipping HTTP server initialization in headless mode');\n }\n\n // Step 7: Initialize queue workers (for background job processing)\n if (!this.isPlatformMode) {\n this.logger.info('🐰 Initializing queue workers...');\n try {\n // Headless job-processing runtimes (minions) still connect to\n // RabbitMQ here — their own tick consumer needs the adapter\n // connection + topology channel — but must NOT consume the\n // shared operations/scheduled/callbacks queues, or RabbitMQ\n // round-robins the scheduled-cron ticks onto them and they\n // dead-letter every tick they can't interpret. We also turn\n // OFF queue monitoring for those runtimes: it watches exactly\n // those four shared queues (which this runtime doesn't own),\n // and the backend-api pod already monitors them.\n await this.queueWorkerInitializer.initialize(\n skipJobConsumers\n ? { startJobConsumers: false, enableMonitoring: false }\n : undefined,\n );\n this.logger.info('✅ Queue workers initialized (if RabbitMQ configured)');\n } catch (error) {\n // Queue workers failing shouldn't prevent app from starting\n this.logger.warn('⚠️ Queue worker initialization skipped or failed:', error);\n }\n\n // Step 7.5: Sync cron jobs to crontabs-batches-manager\n if (this.shouldSyncCronJobs({ skipCronSync })) {\n this.logger.info('🕐 Syncing cron jobs to crontabs-manager...');\n try {\n // Initialize the sync service\n this.cronJobSyncService.initialize();\n\n // Sync cron jobs WITHOUT awaiting. Transient failures do not fail startup:\n // CronJobSyncBackendService keeps one capped, process-lifecycle-aware\n // reconciliation retry pending. It must not HOLD startup either: the remote\n // client waits for crontabs-manager's readiness with no bound, and that\n // readiness depends on apps-manager's. Awaited, one unready platform\n // service stalled every later step for ~20 minutes (2026-09-14), while the\n // HTTP server was already answering.\n void this.cronJobSyncService.syncCronJobsToManager().catch((error: unknown) => {\n this.logger.error('Unexpected cron job sync failure', { ...projectCaughtErrorLogFields(error) });\n });\n } catch (error) {\n // This catch is a final guard for an unexpected service\n // defect in `initialize()`; ordinary remote failures are contained and\n // retried by CronJobSyncBackendService.\n this.logger.error('Unexpected cron job sync failure:', error);\n }\n } else {\n this.logDebug('Skipping cron job sync for this runtime profile');\n }\n } else {\n this.logDebug('Skipping queue worker initialization in platform mode');\n }\n\n /*\n * Step 7.65: resolve the CANONICAL application identity once, so the synchronous\n * scope-derivation sites can read it without a repository round trip.\n *\n * Placed immediately before seeding because that is the earliest point the APPLICATION\n * row is guaranteed to exist — the seed dispatcher refuses outright without it — and\n * because every seeded row anchored to the application scope should be written under the\n * same id the request paths will later filter on.\n *\n * Deliberately NOT swallowed. A backend that cannot name its own application would go on\n * to write `applicationId` columns from `AppConfigurationService.applicationId`, which is\n * the PLATFORM's id and matches no scope predicate — silently, and unrecoverably for the\n * rows written meanwhile. Failing the boot is the cheaper outcome.\n */\n await this.primeApplicationIdentityStep();\n\n // Step 7.7: Data-seeding subsystem — run the application-lifecycle seed passes (Phase 2.F of the\n // seeding-first-class plan). The declarations were wired at Step 5.9, before the HTTP server listened.\n // Extracted into `runDataSeedingStep()` so it can be unit-tested in\n // isolation without standing up the full 30+ dependency boot chain.\n await this.runDataSeedingStep();\n\n // Step 7.8: Report — not enforce — the last-super-administrator floor. Runs AFTER\n // seeding so a seeded first administrator counts; see `reportSuperAdminFloor()` for why\n // this can never be fatal.\n await this.reportSuperAdminFloor();\n\n // Step 7.9: The per-tenant twin. Separate call, separate report: the application floor\n // answers \"can anyone administer this deployment\", this one answers \"which tenants can\n // nobody administer\" — different populations, different remedies, and an operator\n // needs both named rather than one folded into the other.\n await this.reportOrganizationOwnerFloor();\n\n // Step 7.91: The APPLICATION-OWNER organization (#1054) — a third population question of\n // the same family, and the only one that can be answered wrongly by a DIRECT DATABASE\n // EDIT rather than by an unguarded write path. Non-fatal for the same reason as its two\n // neighbours: a diagnostic must never be why startup fails.\n await this.reportApplicationOwnerOrganization();\n\n // Step 7.95: The CEILING, beside the two floors. They ask \"is there at least one\n // administrator\"; this asks \"who are they\" — the enumeration a periodic privileged-access\n // review reads (#202). Same non-fatal posture, same gate, and it decides nothing.\n await this.reportPrivilegedAccessPopulation();\n\n // Step 7.10: Report — never enforce — which of the APPLICATION's own resources have said\n // nothing about whether their rows are about people. Reads the registry only: no database,\n // no execution context, so unlike the two floors above it needs nothing to be seeded and\n // cannot be confined to an empty set by a wrong context.\n this.reportApplicationPersonalDataDeclarations();\n\n // Step 7.11: Report — never repair — stored provider credentials no current-contract lookup reaches because\n // their slot name is one the provider no longer declares (#624). Same non-fatal posture as\n // the reports above: it reads the two credential stores and decides nothing.\n await this.reportStoredProviderCredentialSlots(\n container?.isBound?.(SAAS_SERVICE_TYPES.SystemAccessService)\n ? container.get(SAAS_SERVICE_TYPES.SystemAccessService) as SystemAccessBackendService\n : undefined,\n );\n\n // Step 8: Validate initialization\n await this.validateInitialization({ headlessMode });\n\n // Step 8.5: If the application's authored authentication policy (`userTypes.*.auth` —\n // MFA, password, lockout, enabled methods, step-up, session) moved since the last boot,\n // record it in the audit trail. Emitted HERE — after `validateInitialization`, with the\n // repositories registry and the audit boundary live and the resolved policy in effect —\n // because this boot is where the change takes effect and there is no human actor to name\n // (the \"who authored it\" lives in the deployment / source history).\n //\n // Gated three ways: `applicationConfig` is undefined in platform mode (the platform-gate);\n // and `!headlessMode` restricts the emit to the auth-SERVING runtime. A minion boots this\n // same lifecycle headlessly (`headlessMode: true`) with the SAME app config, so without\n // this gate every minion would write a duplicate row for one change — and a background\n // runtime that serves no HTTP/auth is not the honest emitter of an authentication-policy\n // change anyway. `shouldInitializeHttpServer` draws the identical `!headlessMode` line.\n // (Horizontally-scaled serving replicas can still race to one extra row per change; that\n // is safe over-recording in an append-only trail — the gap this closes is UNDER-recording.)\n // The service call is fully self-contained and fire-and-forget, so it cannot fail boot.\n //\n // assurance-control: WILDO.AUDIT.SECURITY_EVENT WILDO.IDENTITY.SESSION_ASSURANCE — the boot-time\n // activation point that guarantees a change to the authored authentication-assurance policy is\n // evidenced, from the auth-serving runtime, on the deployment that puts it into effect.\n if (applicationConfig && this.auditLogsService && !headlessMode) {\n // The audit writer resolves the local owning identity before any persistence or fanout.\n // Authentication and audit-viewer policies are observed together without inventing a user type.\n await this.auditLogsService.emitApplicationAuthPolicyChangeIfChanged({\n userTypes: applicationConfig.userTypes,\n auditApplicationReadAccess: applicationConfig.auditTrail?.applicationReadAccess,\n });\n }\n\n this.isInitialized = true;\n\n\n // Step 9: Display debug information (after initialization is complete)\n this.logDebug('📋 Displaying implemented Mongoose schemas...');\n this.debugDisplayMongooseSchemas({\n showSchemaStructure: true,\n showIndexes: true,\n maxFieldDepth: 2,\n });\n\n this.logDebug('🌐 Displaying registered routes...');\n this.debugDisplayRegisteredRoutes();\n\n this.logDebug('🎉 Backend application initialization completed successfully');\n\n } catch (error) {\n // This orchestration layer does not handle the failure; it propagates\n // it to the runtime host. Logging here would duplicate the terminal\n // process-boundary record and lose host identity/context.\n throw error;\n }\n }\n\n /**\n * Initialize the webhook auto-controller with its dependencies.\n *\n * Must run BEFORE the controllers registry mounts the controller's router:\n * `initialize()` is what actually registers the webhook routes (the route\n * set is data-dependent and the webhook handler is not constructor-injected,\n * so the base class's constructor-time `setupRoutes()` hook is a no-op — see\n * `WebhookAutoControllerBackendService.initialize()` for the full rationale).\n * Async because route definitions are read from first-class provider runtime contracts.\n */\n /**\n * Validate and register the application's inbound handlers (#1596). Throws — never warns — on any\n * misdeclaration, including a provider that holds the reserved `app` provider ref and a provider\n * endpoint owned by both a capability handler and an inbound handler.\n */\n private registerInboundHandlers(container: any, declaredHandlers: AnyDeclaredInboundHandler[]): void {\n // #1630: channel handlers are declared beside endpoint handlers and registered in this same fatal step.\n const inboundHandlers = declaredHandlers.filter((handler): handler is AnyInboundHandlerDefinition => !isInboundChannelHandler(handler));\n const channelHandlers = declaredHandlers.filter(isInboundChannelHandler);\n // #1600: the email channel's stage 1 — the provider's notification endpoint bound to the engine's email\n // intake — joins the endpoint handlers in this same fatal registration.\n const emailIntakeHandler = this.buildInboundEmailIntakeHandler(container, channelHandlers.length > 0);\n if (emailIntakeHandler) inboundHandlers.push(emailIntakeHandler);\n const registry = container.get(SAAS_SERVICE_TYPES.InboundHandlerRegistryService) as InboundHandlerRegistryBackendService;\n const backendProviderRegistry = this.backendProviderRegistryService;\n const endpointKeysByProviderRef = new Map<string, readonly string[]>();\n const endpointsByProviderRef = new Map<string, readonly Hook_Endpoint[]>();\n for (const provider of backendProviderRegistry.getProvidersWithProtocol(ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR)) {\n const providerRef = provider.metadata.ref;\n const enabled = this.externalProvidersRegistryService.isProviderEnabled(providerRef, ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR);\n const configuration = enabled\n ? this.externalProvidersRegistryService.getProviderConfiguration(providerRef, ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR) as { endpoints?: readonly Hook_Endpoint[] } | undefined\n : undefined;\n const endpoints = configuration?.endpoints ?? [];\n // Every provider that declares the protocol is listed, enabled or not, so the reserved-ref\n // refusal cannot be dodged by disabling the provider for one boot.\n endpointKeysByProviderRef.set(providerRef, endpoints.map((endpoint) => endpoint.key));\n endpointsByProviderRef.set(providerRef, endpoints);\n }\n registry.register(inboundHandlers, {\n endpointKeysByProviderRef,\n // The live role table, loaded at startup before this step, so inheritance is checked against the\n // application's own roles and not only the names a handler spelled.\n roleHierarchy: (role, scope) => this.authorizationsService.getRoleHierarchy(role as never, scope),\n });\n\n const webhookAutoController = container.get(SAAS_SERVICE_TYPES.WebhookAutoController) as WebhookAutoControllerBackendService;\n for (const handler of inboundHandlers) {\n if (handler.source.kind !== InboundSourceKind.PROVIDER_ENDPOINT) continue;\n const { providerRef, endpointKey } = handler.source;\n const endpoint = endpointsByProviderRef.get(providerRef)?.find((candidate) => candidate.key === endpointKey);\n if (endpoint && webhookAutoController.hasCapabilityHandler(endpoint.capability)) {\n throw new InboundHandlerDeclarationError(\n `handler '${handler.ref}' binds '${providerRef}:${endpointKey}', which the '${endpoint.capability}' capability handler already owns; a source has exactly one handler`,\n );\n }\n }\n this.registerInboundChannelHandlers(container, registry, inboundHandlers, channelHandlers);\n if (declaredHandlers.length > 0) {\n this.logger.info(`Inbound handlers registered: ${declaredHandlers.map((handler) => handler.ref).join(', ')}`);\n }\n }\n\n /**\n * Channel handlers (#1630): validated FATALLY like endpoint handlers, then admitted to the endpoint\n * registry as dispatchables so #1596's worker runs them. The email channel is served when\n * `EMAIL_INBOUND` is enabled AND a provider is selected for it; the dispatchable's origin is that\n * provider's notification endpoint.\n */\n private registerInboundChannelHandlers(\n container: any,\n registry: InboundHandlerRegistryBackendService,\n endpointHandlers: readonly AnyInboundHandlerDefinition[],\n channelHandlers: readonly AnyDeclaredInboundHandler[],\n ): void {\n const channels = container.get(SAAS_SERVICE_TYPES.InboundChannelHandlerRegistryService) as InboundChannelHandlerRegistryBackendService;\n const runtime = container.get(SAAS_SERVICE_TYPES.InboundChannelRuntimeService) as InboundChannelRuntimeBackendService;\n const emailInboundEnabled = this.externalProvidersRegistryService.isEngineCapabilityEnabled(EngineCapability.EMAIL_INBOUND);\n const emailInboundProvider = this.externalProvidersRegistryService.getPrimaryProviderForEngineCapability(EngineCapability.EMAIL_INBOUND);\n channels.register(channelHandlers.filter(isInboundChannelHandler), {\n channelServed: () => ({ enabled: emailInboundEnabled, providerSelected: emailInboundProvider !== undefined }),\n endpointHandlerRefs: new Set(endpointHandlers.map((handler) => handler.ref)),\n roleHierarchy: (role, scope) => this.authorizationsService.getRoleHierarchy(role as never, scope),\n });\n if (channels.getHandlers().length === 0 || !emailInboundProvider) return;\n const contract = this.externalProvidersRegistryService.getProviderRuntimeContract(emailInboundProvider, ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER) as { notificationEndpointKey?: string } | undefined;\n if (!contract?.notificationEndpointKey) {\n throw new InboundHandlerDeclarationError(`the EMAIL_INBOUND provider '${emailInboundProvider}' declares no email-inbound runtime contract, so no message could reach a channel handler`);\n }\n registry.registerChannelDispatchables(channels.getHandlers().map((handler) =>\n runtime.toDispatchable(handler, { providerRef: emailInboundProvider, endpointKey: contract.notificationEndpointKey! })));\n }\n\n /**\n * The email channel's stage-1 handler (#1600), when the application receives email: EMAIL_INBOUND enabled, a\n * provider selected, and channel handlers declared. Refuses — FATALLY, like every other step here — a provider\n * whose base URL is overridden outside development and test (E7) — which is also what gates the DNS stand-in.\n */\n private buildInboundEmailIntakeHandler(container: any, channelHandlersDeclared: boolean): AnyInboundHandlerDefinition | null {\n const provider = container.get(SAAS_SERVICE_TYPES.InboundEmailProviderService) as InboundEmailProviderBackendService;\n // The SENDING provider's override too: the test lane captures replies at the same stand-in (E7).\n const sendingProviderRef = this.externalProvidersRegistryService.getPrimaryProviderForEngineCapability(EngineCapability.EMAIL_TRANSACTIONAL);\n if (sendingProviderRef) {\n const sending = this.externalProvidersRegistryService.getProviderRuntimeContract(sendingProviderRef, ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER) as { baseUrlOverrideEnvVarName?: string } | undefined;\n assertNoProviderBaseUrlOverrideOutsideDevelopment({\n providerRef: sendingProviderRef,\n envVarName: sending?.baseUrlOverrideEnvVarName,\n environment: readDeclaredOutboundAdmissionEnvironment(container.get(SAAS_SERVICE_TYPES.AppConfigService)),\n });\n }\n if (!provider.isEnabled()) return null;\n provider.assertStartupSafe();\n if (!channelHandlersDeclared) return null;\n const providerRef = this.externalProvidersRegistryService.getPrimaryProviderForEngineCapability(EngineCapability.EMAIL_INBOUND)!;\n const contract = this.externalProvidersRegistryService.getProviderRuntimeContract(providerRef, ExternalProvider_ExchangeProtocol_Kind.EMAIL_INBOUND_PROVIDER) as { notificationEndpointKey?: string } | undefined;\n if (!contract?.notificationEndpointKey) {\n throw new InboundHandlerDeclarationError(`the EMAIL_INBOUND provider '${providerRef}' declares no email-inbound runtime contract, so no message could reach a channel handler`);\n }\n return createInboundEmailNotificationHandler({\n providerRef,\n endpointKey: contract.notificationEndpointKey,\n reception: container.get(SAAS_SERVICE_TYPES.InboundEmailReceptionService) as InboundEmailReceptionBackendService,\n });\n }\n\n private async initializeWebhookAutoController(container: any): Promise<void> {\n const inbound = {\n registry: container.get(SAAS_SERVICE_TYPES.InboundHandlerRegistryService) as InboundHandlerRegistryBackendService,\n receiver: container.get(SAAS_SERVICE_TYPES.InboundDeliveryReceiverService) as InboundDeliveryReceiverBackendService,\n };\n // FATAL, and before the provider pass below: the application's own inbound endpoints must not be\n // left unmounted by a provider's failure, which that pass only logs (#1596).\n (container.get(SAAS_SERVICE_TYPES.WebhookAutoController) as WebhookAutoControllerBackendService).mountApplicationEndpoints(inbound);\n try {\n const webhookHandler = container.get(SAAS_SERVICE_TYPES.WebhookHandlerService) as WebhookHandlerBackendService;\n const webhookAutoController = container.get(SAAS_SERVICE_TYPES.WebhookAutoController) as WebhookAutoControllerBackendService;\n\n await webhookAutoController.initialize(webhookHandler, inbound);\n this.logDebug('🔗 Webhook auto-controller initialized');\n } catch (error) {\n // Non-fatal — if no webhook providers are registered, this is expected\n this.logger.warn('Webhook auto-controller initialization skipped', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /**\n * Initialize billing services when billing is enabled.\n *\n * Resolves the billing provider from the external connectors system\n * and initializes all billing services (product catalog sync,\n * usage metering, promotions, custom implementations) and wires up webhooks.\n */\n private async initializeBillingServices(\n container: any,\n billingConfig: BillingConfiguration,\n appProductDefinitions?: ProductDefinition[],\n ): Promise<AnyInboundHandlerDefinition | null> {\n this.logDebug('💳 Initializing billing services...');\n\n // Resolve the billing provider BEFORE the non-fatal try below.\n //\n // \"billing.enabled = true but no provider resolvable\" is an\n // INCOHERENT CONFIG, not a runtime hiccup, and must FAIL LOUD at\n // startup. The previous warn-and-return silently degraded: billing\n // resources stayed registered (enabled ⇒ not excluded) but the\n // back-office services that register their operation paths + run\n // the org auto-create never initialized. The result was request-\n // time FATALs (`resources_registry_operation_path_not_found` on\n // `organizationBillingAccounts` / `products` / `prices` /\n // `promotions`) during org provisioning — exactly the\n // silent-degradation anti-pattern the design philosophy forbids.\n //\n // The try/catch further down stays scoped to RUNTIME init errors\n // (a provider that resolves but then throws mid-wire) which remain\n // non-fatal. Config incoherence is a different, fatal class.\n const resolution = await this.resolveBillingProvider(billingConfig);\n // Literal equality, not truthiness: this package compiles without `strictNullChecks`, under which\n // `!resolution.resolved` cannot exclude the success member (its `true` may still be null there).\n if (resolution.resolved === false) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: describeBillingProviderResolutionFailure(\n resolution.reason,\n billingConfig,\n resolution.detail,\n ),\n providerRef: billingConfig.providerRef ?? null,\n resolutionFailureReason: resolution.reason,\n },\n });\n }\n // Captured while `resolution` is narrowed to its success variant — the ref rows are stamped with.\n const billingProviderRef = resolution.providerRef;\n // Every consumer below receives the adapter WRAPPED, so each call it makes to the vendor leaves an outbound record\n // (#1712). Wrapped here, once, rather than inside the adapter: see `billing-provider-call-recording.backend.ts`.\n // assurance-control: WILDO.INTEGRATION.OUTBOUND_ACTIVITY_AUDIT — every billing call to the vendor is recorded.\n const capabilityCallRecorder = container?.isBound?.(SAAS_SERVICE_TYPES.ProviderCapabilityCallRecorder)\n ? container.get(SAAS_SERVICE_TYPES.ProviderCapabilityCallRecorder) as ProviderCapabilityCallRecorderBackendService\n : undefined;\n const billingProvider = capabilityCallRecorder === undefined\n ? resolution.provider\n : recordBillingProviderCalls(resolution.provider, { providerRef: billingProviderRef, recorder: capabilityCallRecorder });\n // Prepared inside the non-fatal try once the router exists, and BUILT after it (#1629): the handler's own declaration checks\n // (a billing endpoint with no scope binding, a role an engine handler may not hold) are code defects that must stop startup, not\n // be read as a provider-API failure the application may run without — which would leave the provider retrying into a 404.\n let buildBillingInboundHandler: (() => AnyInboundHandlerDefinition) | null = null;\n\n try {\n // 2. Get billing services from DI container\n const catalogSync = container.get(SAAS_SERVICE_TYPES.ProductCatalogSyncService) as ProductCatalogSyncBackendService;\n const usageMetering = container.get(SAAS_SERVICE_TYPES.UsageMeteringService) as UsageMeteringBackendService;\n const billingReconciliation = container.get(SAAS_SERVICE_TYPES.BillingReconciliationService) as BillingReconciliationBackendService;\n\n // 3. Product definitions from the custom app (like customRoles, customFeatureDefinitions)\n const productDefinitions: ProductDefinition[] = appProductDefinitions ?? [];\n\n // 4. Initialize services in dependency order\n await catalogSync.initialize(productDefinitions, billingProvider);\n await usageMetering.initialize(billingProvider);\n // Every write of a subscription's provider-authoritative fields outside its own mutations — the webhooks and the\n // reconciliation sweep — goes through that subscription's mutation slot (#535 S6). One projection serves both, and\n // its slot identity names the configured application, never a request context's.\n const subscriptionProjection = new BillingSubscriptionProviderProjection({\n repositoriesRegistry: this.repositoriesRegistryService,\n unitOfWork: container.get(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService) as ResourcePersistenceUnitOfWorkBackendService,\n applicationId: () => resolveBillingMutationApplicationId(this.appConfigService),\n providerRef: () => billingConfig.providerRef,\n });\n // The reconciliation sweep needs the provider handle and that projection. Initialized here rather than lazily so a\n // deployment whose provider fails to resolve never reaches a state where the batch is registered and the service\n // behind it is not.\n await billingReconciliation.initialize(billingProvider, subscriptionProjection);\n // Recovery resends and reads back through the same resolved provider (#535 S7a).\n (container.get(SAAS_SERVICE_TYPES.BillingSubscriptionMutationRecoveryService) as BillingSubscriptionMutationRecoveryBackendService)\n .initialize(billingProvider);\n /*\n * Publish it for the post-operation usage hook (#415). A module-level seam rather than a\n * DI edge because the metering service injects the services registry and the hook lives\n * on that registry — injecting it there would be a container cycle. Set HERE, inside the\n * billing bootstrap, so an application with no billing leaves the getter null and the\n * hook costs one null check per write.\n */\n setUsageMeteringService(usageMetering);\n // The referral program (#1802), published through the same kind of seam and for the same reason.\n setReferralProgramService(container.get(SAAS_SERVICE_TYPES.ReferralProgramService) as ReferralProgramBackendService);\n\n // 4b. Register the provider-side half of subject erasure.\n //\n // Registered HERE, inside the billing bootstrap, because that is what keeps the erasure\n // orchestrator domain-agnostic: `system-access` runs whatever declared itself relevant to\n // a subject and never learns that billing exists. It also ties the effect's lifetime to\n // the provider's — a deployment with no billing provider configured registers nothing,\n // rather than registering an effect that would fail at erasure time.\n container\n .get(SAAS_SERVICE_TYPES.SubjectErasureExternalEffectsService)\n .register(createBillingSubjectErasureEffect({\n billingProviderRef,\n getBillingProvider: () => billingProvider,\n listBillingAccountsForSubject: async (billingAccountResourceType, scopeFieldName, subjectIds) => {\n const systemAccess = container.get(SAAS_SERVICE_TYPES.SystemAccessService) as SystemAccessBackendService;\n return normalizeSystemListResult(await systemAccess.listAsSystem(\n billingAccountResourceType,\n { [scopeFieldName]: { $in: subjectIds } },\n )) as Array<{ _id: string; providerCustomerId?: string }>;\n },\n listActiveSubscriptions: async (subscriptionResourceType, billingAccountFkField, billingAccountId) => {\n const systemAccess = container.get(SAAS_SERVICE_TYPES.SystemAccessService) as SystemAccessBackendService;\n return normalizeSystemListResult(await systemAccess.listAsSystem(\n subscriptionResourceType,\n {\n [billingAccountFkField]: billingAccountId,\n status: { $nin: TERMINAL_SUBSCRIPTION_STATUSES },\n },\n )) as Array<{ _id: string; providerSubscriptionId?: string }>;\n },\n logWarn: (message, context) => this.logger.warn(message, context),\n /*\n * Answered from the REGISTRY, not from `billingConfig.enabledScopes` — same\n * reasoning as `AbstractBillingBackendService.activeBillingScopeVariants`:\n * enabledScopes is the INPUT to the exclusion and the registry is its RESULT,\n * so a second read of the input is a copy free to drift.\n *\n * Evaluated per CALL rather than captured here: this closure is built during\n * startup and an erasure runs much later, so binding the answer now would pin\n * a boot-time reading into an effect that outlives it.\n */\n userBillingScopeIsRegistered: () => this.resourcesRegistryService\n .getResourceTypes()\n .includes(BILLING_SCOPE_TO_VARIANTS.userId.billingAccount as ResourceType),\n }));\n this.logDebug('🧹 Billing subject-erasure effect registered');\n\n // 4a. Sync product catalog to DB (ensures products/prices exist before billing state endpoint queries them)\n try {\n const syncResult = await catalogSync.syncProductCatalog();\n this.logDebug('📦 Product catalog synced at startup', {\n synced: syncResult.synced,\n created: syncResult.created,\n updated: syncResult.updated,\n featuresDirty: syncResult.featuresDirty.length,\n });\n } catch (syncError) {\n this.logger.warn('⚠️ Product catalog startup sync failed (non-fatal)', {\n ...projectCaughtErrorLogFields(syncError),\n });\n }\n\n // 4b. Initialize billing custom implementations (late-binding for resource-centric operations)\n const featureSync = container.get(SAAS_SERVICE_TYPES.BillingFeatureSyncService) as BillingFeatureSyncBackendService;\n const billingStateService = container.get(SAAS_SERVICE_TYPES.BillingStateService) as BillingStateBackendService;\n initializeBillingCustomImplementations(billingProvider, featureSync, billingStateService, billingConfig, this.errorBuilder, billingProviderRef);\n\n // 4c. Register post-operation hooks (feature sync fires automatically after subscription mutations)\n registerBillingPostOperationHooks(this.servicesRegistryService);\n\n // 5. Wire up billing webhooks (#1629). The provider's adapter still VERIFIES every request (Stripe's SDK\n // `constructEvent`); the durable inbound path stores, retries and replays it, and billing's ENGINE inbound\n // handler runs it under its declared roles. The handler is returned and registered in the fatal step.\n const webhookHandler = container.get(SAAS_SERVICE_TYPES.WebhookHandlerService) as WebhookHandlerBackendService;\n const billingAdapter = new BillingWebhookAdapter(billingProvider, billingConfig.providerRef);\n webhookHandler.registerAdapter(billingConfig.providerRef, BILLING_WEBHOOK_ENDPOINT_KEY, billingAdapter);\n\n const webSocketService = container.get(SAAS_SERVICE_TYPES.WebSocketService) as WebSocketService;\n setBillingWebSocketService(webSocketService);\n const webhookEventRouter = new BillingWebhookEventRouterBackendService(this.servicesRegistryService, this.resourcesRegistryService, this.logger, webSocketService, this.repositoriesRegistryService, subscriptionProjection);\n const billingEndpoint = this.externalProvidersRegistryService.isProviderEnabled(billingConfig.providerRef, ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR)\n ? (this.externalProvidersRegistryService.getProviderConfiguration(billingConfig.providerRef, ExternalProvider_ExchangeProtocol_Kind.WEBHOOK_ORIGINATOR) as { endpoints?: readonly Hook_Endpoint[] } | undefined)\n ?.endpoints?.find((endpoint) => endpoint.key === BILLING_WEBHOOK_ENDPOINT_KEY)\n : undefined;\n if (billingEndpoint) {\n buildBillingInboundHandler = () => createBillingInboundHandler({\n providerRef: billingConfig.providerRef,\n endpoint: billingEndpoint,\n billingProvider,\n router: webhookEventRouter,\n catalogContext: (resourceType, operation) => this.executionContextCreatorBackendService.createForInternalServiceOperation({ resourceType, operationIdentifier: operation }),\n isResourceTypeServed: (resourceType) => this.repositoriesRegistryService.getRepository(resourceType as ResourceType) !== undefined,\n });\n } else {\n // Same outcome as before #1629 (no route): an application that enables billing but no webhook endpoint\n // receives no provider events. Said loudly, because the reconciliation sweep is then its only sync.\n this.logger.error(`Billing provider '${billingConfig.providerRef}' declares no enabled '${BILLING_WEBHOOK_ENDPOINT_KEY}' webhook endpoint — billing receives no provider events`);\n }\n\n this.logDebug('✅ Billing services initialized successfully', {\n providerRef: billingConfig.providerRef,\n enabledScopes: billingConfig.enabledScopes,\n });\n } catch (error) {\n // Billing initialization failure is non-fatal: the app can still run without billing\n this.logger.error('❌ Billing services initialization failed (billing will be unavailable)', {\n ...projectCaughtErrorLogFields(error),\n });\n }\n return buildBillingInboundHandler ? buildBillingInboundHandler() : null;\n }\n\n /**\n * Resolve the StandardBilling_Interface from the external providers system.\n *\n * Flow:\n * 1. Get the billing providerRef from config (e.g., 'stripe')\n * 2. Verify the configured provider exposes the billing protocol\n * 3. Load the billing runtime contract from the backend provider registry\n *\n * Returns a discriminated {@link BillingProviderResolution}: on failure the\n * `provider` is null and a `reason` (plus optional `detail`) names the exact\n * config surface at fault, so the startup guard can route the operator to the\n * right fix (scope authoring vs. secret vs. disabled) rather than a catch-all.\n */\n private async resolveBillingProvider(billingConfig: BillingConfiguration): Promise<BillingProviderResolution> {\n const providerRef = billingConfig.providerRef;\n if (!providerRef) {\n this.logDebug('No billing providerRef configured');\n return { resolved: false, reason: BillingProviderResolutionFailureReason.PROVIDER_REF_UNSET };\n }\n\n try {\n const runtimeContract = this.backendProviderRegistryService.getRuntimeContract(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n );\n if (runtimeContract?.kind !== ProviderProtocolRuntimeKind.BILLING) {\n // No billing runtime contract exposed to the backend registry for\n // this ref — the provider was filtered out of the active catalog\n // because it is not authored in `providers.scopes.backend`, or the\n // artifact has not been regenerated since it was. This is distinct\n // from \"secret missing\": the ref never reached the backend host.\n this.logDebug('Billing provider not reachable on the backend runtime', { providerRef });\n return {\n resolved: false,\n reason: BillingProviderResolutionFailureReason.PROVIDER_NOT_REACHABLE_ON_BACKEND,\n };\n }\n\n if (!this.externalProvidersRegistryService.isProviderEnabled(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n )) {\n this.logDebug('Billing provider disabled by external provider configuration', { providerRef });\n return { resolved: false, reason: BillingProviderResolutionFailureReason.PROVIDER_DISABLED };\n }\n\n // WHICH adapter serves this provider is asked BEFORE the secret is read, and the order\n // is deliberate: an unserved provider is a framework gap, and reporting \"your secret is\n // missing\" for it would send an operator to populate a credential that could never have\n // been used. Ask the answerable question first.\n //\n // The lookup is keyed on the contract's declared `sdkPackage`, never on the provider\n // ref, so `no-provider-ref-branches.guard.test.ts` still holds — and so does the\n // principle behind it, because nothing here BRANCHES: the registry answers which of the\n // adapters this engine ships serves the declaration, exactly as\n // `EngineBackendProviderRegistry.modules` answers which module serves a ref.\n //\n // This replaces a note proposing `sdkFactory: (secretKey, opts) => StandardBilling_Interface`\n // on the runtime contract, \"mirror of the LLM and email surfaces\". It is not reachable and\n // the two cited surfaces are not mirrors of this one — see the registry module's header\n // for the dependency edge that blocks it and what the alternative would cost.\n const adapterFactory = resolveBillingAdapterFactory(runtimeContract.sdkPackage);\n if (!adapterFactory) {\n this.logger.warn('Billing provider declares an sdkPackage this engine ships no adapter for', {\n providerRef,\n sdkPackage: runtimeContract.sdkPackage,\n supported: listSupportedBillingSdkPackages(),\n });\n return {\n resolved: false,\n reason: BillingProviderResolutionFailureReason.NO_ADAPTER_FOR_SDK_PACKAGE,\n detail: runtimeContract.sdkPackage,\n };\n }\n\n const secretRef = runtimeContract.secretRef;\n const secretKey = secretRef\n ? this.externalProvidersRegistryService.getProviderSecret(\n providerRef,\n ExternalProvider_ExchangeProtocol_Kind.BILLING_PROVIDER,\n secretRef,\n )\n : undefined;\n if (!secretKey) {\n this.logger.warn('Billing provider configured but secret is missing', { providerRef, secretRef });\n return {\n resolved: false,\n reason: BillingProviderResolutionFailureReason.SECRET_MISSING,\n detail: secretRef,\n };\n }\n\n this.logDebug('Billing provider resolved from first-class billing runtime contract', {\n providerRef,\n sdkPackage: runtimeContract.sdkPackage,\n });\n return {\n resolved: true,\n provider: adapterFactory({ secretKey, apiVersion: runtimeContract.apiVersion }),\n providerRef,\n };\n } catch (error) {\n const detail = describeCaughtError(error);\n this.logger.warn('Failed to resolve billing provider', { providerRef, error: detail });\n return { resolved: false, reason: BillingProviderResolutionFailureReason.RESOLUTION_ERROR, detail };\n }\n }\n\n async shutdown(): Promise<void> {\n this.logDebug('Starting graceful shutdown');\n\n\n // Cancel delayed cron reconciliation before stopping queue workers, so\n // shutdown cannot start a fresh platform request in the background.\n this.cronJobSyncService.shutdown();\n\n // Then shut down queue workers and wait for in-flight jobs.\n try {\n await this.queueWorkerInitializer.shutdown();\n } catch (error) {\n this.logger.error('Error during queue worker shutdown', error as any);\n }\n }\n /**\n * Check if the application is initialized\n */\n public isApplicationInitialized(): boolean {\n return this.isInitialized;\n }\n\n /**\n * Get application configuration\n */\n public async getAppConfig(): Promise<AppConfiguration> {\n this.ensureInitialized();\n return this.appConfigService.config;\n }\n\n /**\n * Get resources registry\n */\n public getResourcesRegistry(): ResourcesRegistry {\n this.ensureInitialized();\n return this.resourcesRegistryService.getResourcesRegistry();\n }\n\n /**\n * Get repositories registry handler\n */\n public getRepositoriesRegistry(): RepositoriesRegistryHandlerBackendService {\n this.ensureInitialized();\n return this.repositoriesRegistryService;\n }\n\n /**\n * Debug function to display all implemented Mongoose schemas\n * Convenient access to schema debugging from the main application service\n */\n public debugDisplayMongooseSchemas(options: {\n showSchemaStructure?: boolean;\n showIndexes?: boolean;\n showVirtuals?: boolean;\n resourceTypeFilter?: string[];\n maxFieldDepth?: number;\n } = {}): void {\n this.logDebug('\\n🚀 === WILDO.AI BACKEND - MONGOOSE SCHEMAS DEBUG ===\\n');\n\n if (!this.isInitialized) {\n this.logDebug('⚠️ Application not initialized yet. Schemas may not be available.');\n return;\n }\n\n this.repositoriesRegistryService.debugDisplayMongooseSchemas(options);\n }\n\n /**\n * Quick debug summary of all schemas\n */\n public debugShowSchemasSummary(): void {\n this.logDebug('\\n🚀 === WILDO.AI BACKEND - SCHEMAS SUMMARY ===\\n');\n\n if (!this.isInitialized) {\n this.logDebug('⚠️ Application not initialized yet. Schemas may not be available.');\n return;\n }\n\n this.repositoriesRegistryService.debugShowSchemasSummary();\n }\n\n /**\n * Debug function to display all registered routes\n */\n public debugDisplayRegisteredRoutes(): void {\n this.logDebug('\\n🌐 === WILDO.AI BACKEND - REGISTERED ROUTES ===\\n');\n\n if (!this.isInitialized) {\n this.logDebug('⚠️ Application not initialized yet. Routes may not be available.');\n return;\n }\n\n this.controllersRegistryService.displayAllRoutes();\n }\n\n /**\n * Get the controllers registry for route registration\n */\n public getControllersRegistry(): ControllersRegistryHandlerBackendService {\n this.ensureInitialized();\n return this.controllersRegistryService;\n }\n\n /**\n * Get the services registry for business logic access\n */\n public getServicesRegistry(): ServicesRegistryHandlerBackendService {\n this.ensureInitialized();\n return this.servicesRegistryService;\n }\n\n /**\n * Get the HTTP server service instance\n */\n public getHttpServer(): HttpServerBackendService {\n this.ensureInitialized();\n return this.httpServerService;\n }\n\n /**\n * Get the authorizations service instance\n */\n public getAuthorizationsService(): AuthorizationsBackendService {\n this.ensureInitialized();\n return this.authorizationsService;\n }\n\n /**\n * Step 5.9 — data-seed declarations hand-off, before the HTTP server listens.\n *\n * Thin adapter around {@link wireDataSeedingDeclarations}: registers the seed corpus and scope\n * resolvers, and wires the Level-B hooks and LAZY guards. It runs before Step 6 because a request\n * served before the hooks exist runs without its seeds, and a missed `afterCreate` is never retried.\n * Runs in platform mode too (tenant lifecycle hooks must fire regardless of who runs Level A).\n */\n protected wireDataSeedingStep(\n dataSeeds: readonly DataSeedDefinition[] | undefined,\n dataSeedScopeResolvers: Readonly<Record<string, DataSeedScopeResolver>> | undefined,\n runtimeProfile: ApplicationRuntimeProfile = ApplicationRuntimeProfile.APPLICATION_BACKEND,\n ): void {\n wireDataSeedingDeclarations({\n dataSeeds,\n dataSeedScopeResolvers,\n /*\n * The framework's own seeds belong to the runtime that owns the application's data.\n *\n * A MINION or WORKER runs this same bootstrap with a SCOPED services registry that\n * refuses unscoped writes, so a Level-B seed there makes `wireLevelBResourceLifecycleHooks`\n * request access it is designed not to have. The platform is excluded for the narrower\n * reason that it is not an application and never registered these before.\n */\n registersEngineOwnedSeeds:\n runtimeProfile === ApplicationRuntimeProfile.APPLICATION_BACKEND && !this.isPlatformMode,\n logDebug: this.logDebug,\n registry: this.dataSeedRegistryService,\n scopeResolverRegistry: this.dataSeedScopeResolverRegistryService,\n dispatcher: this.dataSeedDispatcherService,\n servicesRegistry: this.servicesRegistryService,\n });\n }\n\n /**\n * Step 7.7 — application-lifecycle seed passes.\n *\n * Thin adapter around {@link runDataSeedingApplicationLifecyclePasses}: this\n * method exists so subclasses (e.g. `PlatformAppsManager_ApplicationStartupService`)\n * can override / observe the step without reaching into the helper, and\n * so the heavy `initialize()` reads as a flat sequence of `await`s.\n *\n * The helpers are unit-tested at\n * `~/data-seeding/services/__tests__/data-seed-application-bootstrap.backend.test.ts`.\n * See their JSDoc for the full contract (declarations are wired at Step 5.9,\n * dispatch is skipped in platform mode, dispatcher failures are FATAL).\n */\n /**\n * Step 7.65 — resolve and cache the canonical application identity.\n *\n * A thin adapter for the same reason `runDataSeedingStep` is one: it keeps `initialize()` a flat\n * sequence of awaits, and it gives a subclass a seam to observe or override the step.\n */\n protected async primeApplicationIdentityStep(): Promise<void> {\n const identity = await this.applicationIdentityService.prime();\n this.logDebug('Canonical application identity resolved', {\n applicationRecordId: identity._id,\n appSlug: identity.appSlug,\n });\n }\n\n protected async runDataSeedingStep(): Promise<void> {\n await runDataSeedingApplicationLifecyclePasses({\n isPlatformMode: this.isPlatformMode,\n logger: this.logger,\n logDebug: this.logDebug,\n dispatcher: this.dataSeedDispatcherService,\n });\n }\n\n /**\n * Report — never enforce — the last-super-administrator floor at startup.\n *\n * ## Why this exists next to the write guards\n *\n * Every write that could remove the last administratively usable super-administrator already\n * refuses (`super-admin-floor.backend.utils`, wired into the USERS role verbs, the core\n * UPDATE, DELETE and subject erasure). So this can only ever observe a breach that arrived\n * around those paths: a direct database edit, a restore from a backup taken mid-erasure, a seed\n * that authored no administrator, or — the one with no user row involved at all — a role-table\n * reconfiguration that dropped or renamed a custom role carrying\n * `inheritFrom: APP_ADMIN_SUPER_ADMIN`, silently reclassifying its holders as non-administrators.\n *\n * ## Why it MUST NOT fail startup\n *\n * A fresh application legitimately boots with zero users: the first administrator arrives\n * through seeding or first-run registration. A framework that refused to start on this data\n * condition would brick every greenfield app on its first run, and — worse — would make the\n * breach unrecoverable in exactly the situation where the operator needs the app up to fix it.\n * The finding is loud (`logger.error` + a CRITICAL audit event) and non-blocking. Rejected:\n * throwing `ErrorType.CONFIGURATION`, for both reasons above.\n *\n * ## Why every failure is swallowed\n *\n * A diagnostic that can take the application down is a worse defect than the one it reports.\n * The floor query needs the users repository and the role table; in platform mode, in reduced\n * runtime profiles, or in a minimal test container, either may legitimately be absent. All of\n * that degrades to a debug line.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — surface the absence of an\n * accountable administrative principal, which is unrecoverable in-product once reached.\n */\n protected async reportSuperAdminFloor(): Promise<void> {\n // Platform mode runs no application user population — there is no floor to measure.\n if (this.isPlatformMode) return;\n /**\n * ONLY the runtime that owns the application's administrative population.\n *\n * The report reads `users` and `organizations` across the whole application. A confined\n * runtime (minion/worker) holds table-scoped grants covering neither, so it cannot perform\n * the read — and has no accountability for the answer even if it could. Observed on a\n * clean-room PostgreSQL boot (2026-08-24): the marketing-scrapper minion produced\n * `permission denied for table users` and `for table organizations` on every startup.\n *\n * It never blocked anything — the report is non-fatal by design — which is precisely why it\n * lasted: a recurring, ignorable error inside an otherwise healthy boot. The application\n * backend still runs both reports, so no observation is lost.\n */\n if (!resolveApplicationRuntimeProfileBootAssertions(this.resolvedRuntimeProfile).reportsAdministrativeContinuityFloors) return;\n\n try {\n if (!this.repositoriesRegistryService.getRepository(CoreResourceType.USERS)) {\n this.logDebug('Skipping the super-administrator floor report: no users repository is registered');\n return;\n }\n\n const executionContext = await this.executionContextCreatorBackendService.createForInternalOperation({\n operation: this.resourcesRegistryService.getServiceOperationPathDefault(\n CoreResourceType.USERS,\n CoreResourceOperation.LIST,\n ),\n initiatorRoles: [\n {\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n relatedPrimaryScope: ResourcePrimaryScope.APPLICATION,\n },\n ],\n });\n\n const population = await measureUsableSuperAdminPopulation({\n executionContext,\n repositoriesRegistry: this.repositoriesRegistryService,\n errorBuilder: this.errorBuilder,\n conferringRoles: resolveSuperAdminConferringRoles(this.authorizationsService),\n });\n\n if (population.meetsFloor) {\n this.logDebug('Super-administrator floor satisfied', {\n usableSuperAdminCount: population.usableSuperAdminCount,\n });\n return;\n }\n\n // ERROR, not warn: there is no in-product remedy — every door that could appoint a new\n // administrator is gated on the role that is missing. The recovery is necessarily\n // out-of-band (a direct database write, or a seed), so the log has to stand alone and\n // say what to do.\n this.logger.error(\n 'No administratively usable super-administrator exists. The application cannot be '\n + 'administered, and no in-product path can grant the role because every such path '\n + 'requires it. Restore one out-of-band (seed or direct database write) by giving an '\n + 'ACTIVE user one of the conferring roles below.',\n {\n usableSuperAdminCount: population.usableSuperAdminCount,\n requiredUsableSuperAdminCount: SUPER_ADMIN_FLOOR_MINIMUM,\n conferringRoles: population.conferringRoles,\n usableStatuses: [...ADMINISTRATIVELY_USABLE_USER_STATUSES],\n },\n );\n\n await this.auditLogsService?.logApplicationSuperAdminFloorBreached({\n usableSuperAdminCount: population.usableSuperAdminCount,\n requiredUsableSuperAdminCount: SUPER_ADMIN_FLOOR_MINIMUM,\n conferringRoles: population.conferringRoles,\n usableStatuses: [...ADMINISTRATIVELY_USABLE_USER_STATUSES],\n }, executionContext);\n } catch (error) {\n // See the header: a diagnostic must never be the reason startup fails.\n this.logDebug('Super-administrator floor report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * Report — never enforce — the last-organization-owner floor, per tenant.\n *\n * The write guards are the protection; this is the only surface that observes states they never\n * saw (a direct database edit, a restore from a backup taken mid-erasure, a seed that authored no\n * owner, or a role-table reconfiguration that changed which roles confer ownership).\n *\n * NON-FATAL, for the same reason as its application twin and one more of its own: a fresh\n * deployment legitimately has zero organizations, and a tenant left ownerless by an out-of-band\n * edit is a condition to report, not a reason to refuse to serve every OTHER tenant.\n *\n * Cost is three queries regardless of tenant count — see\n * {@link measureOrganizationsMissingUsableOwner}. The breached list is logged in full because an\n * operator cannot act on a count, but it is the ONLY thing that scales with the breach, not with\n * the tenant base.\n */\n protected async reportOrganizationOwnerFloor(): Promise<void> {\n // Platform mode runs no tenant population — there is no floor to measure.\n if (this.isPlatformMode) return;\n /**\n * ONLY the runtime that owns the application's administrative population.\n *\n * The report reads `users` and `organizations` across the whole application. A confined\n * runtime (minion/worker) holds table-scoped grants covering neither, so it cannot perform\n * the read — and has no accountability for the answer even if it could. Observed on a\n * clean-room PostgreSQL boot (2026-08-24): the marketing-scrapper minion produced\n * `permission denied for table users` and `for table organizations` on every startup.\n *\n * It never blocked anything — the report is non-fatal by design — which is precisely why it\n * lasted: a recurring, ignorable error inside an otherwise healthy boot. The application\n * backend still runs both reports, so no observation is lost.\n */\n if (!resolveApplicationRuntimeProfileBootAssertions(this.resolvedRuntimeProfile).reportsAdministrativeContinuityFloors) return;\n\n try {\n if (!this.repositoriesRegistryService.getRepository(CoreResourceType.ORGANIZATIONS)\n || !this.repositoriesRegistryService.getRepository(CoreResourceType.ORGANIZATION_MEMBERS)) {\n this.logDebug('Skipping the organization-owner floor report: organization repositories are not registered');\n return;\n }\n\n const authExecutionContextFactory = this.authExecutionContextFactory;\n if (!authExecutionContextFactory) {\n this.logDebug('Skipping the organization-owner floor report: the auth execution-context factory is not bound');\n return;\n }\n\n const population = await measureOrganizationsMissingUsableOwner({\n // The report builds its OWN system context from this factory. It is a whole-estate\n // backstop and must NOT trust a caller-supplied context: a role-less or wrong-execution-\n // type context silently confined the ORGANIZATIONS scope-root read to the empty set and\n // the backstop then reported a healthy estate. See the block comment in\n // `measureOrganizationsMissingUsableOwner`.\n authExecutionContextFactory,\n repositoriesRegistry: this.repositoriesRegistryService,\n errorBuilder: this.errorBuilder,\n conferringRoles: resolveOrganizationOwnerConferringRoles(this.authorizationsService),\n });\n\n // The PREVENTIVE half, and the only one this floor has. A tenant with exactly one usable\n // owner is a single resignation or suspension away from being unadministrable, and it is\n // the population the floor will REFUSE to help — every removal there answers 409 until a\n // second owner exists. WARN, not error: nothing is broken yet, and an error here on a\n // legitimately small tenant would train operators to ignore the channel.\n if (population.singleOwnerOrganizations.length > 0) {\n this.logger.warn(\n 'Organizations have exactly ONE administratively usable owner. Each is one lifecycle '\n + 'event away from being unadministrable, and the owner floor will refuse every removal '\n + 'there until a second owner is granted. Recommend at least two owners per tenant.',\n {\n singleOwnerOrganizationCount: population.singleOwnerOrganizations.length,\n singleOwnerOrganizations: population.singleOwnerOrganizations,\n protectedOrganizationCount: population.protectedOrganizationCount,\n },\n );\n }\n\n if (population.ownerlessOrganizations.length === 0) {\n this.logDebug('Organization-owner floor satisfied for every protected tenant', {\n protectedOrganizationCount: population.protectedOrganizationCount,\n });\n return;\n }\n\n // ERROR, not warn: these tenants cannot administer THEMSELVES, and no member of them can\n // fix it — granting ownership requires the authority they just lost. Recovery exists but\n // is an out-of-tenant operator action, so the log names it rather than leaving the reader\n // to discover there is one. (Until 2026-08-05 this said no in-product path existed at all;\n // `organizationMembers.grantOwnership` is that path.)\n this.logger.error(\n 'Organizations exist with no administratively usable owner. They cannot administer '\n + 'themselves, and no member of them can repair it — granting ownership requires the '\n + 'authority that was lost. Repair from the platform tier with '\n + '`organizationMembers.grantOwnership`, which promotes an EXISTING member of the tenant '\n + 'and requires APP_ADMIN_SUPER_ADMIN. Failing that, restore out-of-band by giving an '\n + 'ACTIVE member an ACTIVE membership with a conferring role.',\n {\n ownerlessOrganizationCount: population.ownerlessOrganizations.length,\n protectedOrganizationCount: population.protectedOrganizationCount,\n ownerlessOrganizations: population.ownerlessOrganizations,\n requiredUsableOwners: ORGANIZATION_OWNER_FLOOR_MINIMUM,\n conferringRoles: resolveOrganizationOwnerConferringRoles(this.authorizationsService),\n usableMembershipStatuses: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES],\n usableOwnerUserStatuses: [...ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES],\n },\n );\n\n /*\n * An AUDIT ROW per stranded tenant, beside the log line — the half this report was missing.\n *\n * The APPLICATION twin above has emitted `logApplicationSuperAdminFloorBreached` from the\n * start, and the sibling that watches ALLOWED lifecycle writes emits the organization event\n * per stranded tenant with the reasoning stated at its call site: a log line is not\n * queryable evidence and never reaches a SIEM. This report — the only surface that observes\n * a tenant stranded by a route no guard ever saw — wrote log lines and nothing else, so the\n * breach with the WORST provenance was the one with no trail.\n *\n * `detectedBy: BOOT_REPORT` is what a reader needs and cannot infer: it separates \"a guarded\n * write let this through\" from \"we found it already broken\". The action fields are omitted\n * rather than filled, because there is no action to name.\n *\n * One row per tenant, matching the sibling: an operator who learns about them one at a time\n * cannot plan the remediation. Each is awaited but individually guarded — a failing audit\n * write must not cost the remaining tenants their rows, and must never be why startup fails.\n */\n for (const stranded of population.ownerlessOrganizations) {\n try {\n await this.auditLogsService?.logOrganizationOwnerFloorBreached({\n organizationId: stranded.organizationId,\n detectedBy: AdministrativeContinuityBreachDetection.BOOT_REPORT,\n remainingUsableOwners: 0,\n // The boot report is the application observing its own state: SYSTEM (#1595).\n }, undefined, SYSTEM_AUDIT_PRINCIPAL);\n } catch (error) {\n this.logDebug(\n 'Organization-owner floor breach could not be recorded in the audit trail',\n projectCaughtErrorLogFields(error),\n );\n }\n }\n } catch (error) {\n // See the header: a diagnostic must never be the reason startup fails.\n this.logDebug('Organization-owner floor report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * Report — never enforce — the state of the APPLICATION-OWNER organization (#1054).\n *\n * An application whose declaration marks one organization type with `ownsApplication` must have\n * exactly one organization of it. This says so at boot, at a moment an operator is present, and\n * decides nothing.\n *\n * ## Why it exists when three write guards already do\n *\n * Every door that could produce a second owner organization is shut: all three service-tier CREATE\n * variants refuse the owner type BY DOOR, and `promoteToOwnerOrganization` refuses when one\n * exists and serializes against a concurrent promotion. So the only remaining producers are\n * outside the product entirely — a direct database edit, a restore from a mid-migration backup, a\n * seed written before the marker was declared. This is the one surface that observes a state no\n * write guard ever evaluated, which is exactly the argument the owner-floor report makes for\n * itself two methods above.\n *\n * ## Three findings, three severities, and the zero case is deliberately not one\n *\n * - **Several owner organizations** — ERROR. Everything that resolves through the marker is\n * currently answering nothing (the resolver refuses to CHOOSE, by design), so the application is\n * operating with no owner at all until an operator leaves exactly one.\n * - **None yet** — WARN. On a fresh installation this is the ordinary state until the platform\n * seeds the first administrator's organization, and an ERROR there would train an operator to\n * ignore the channel on every first boot of every correct application.\n * - **No marked type** — SILENT. Most applications are sold to many tenants and no organization\n * operates them; saying so on every boot would be noise about the default.\n *\n * ## Why it inherits both gates, contrary to the plan's R20\n *\n * R20 asked that this report NOT inherit `isPlatformMode` and the runtime-profile flag. Re-reading\n * what each measures says otherwise, and the deviation is recorded rather than silent:\n *\n * - `isPlatformMode` — the platform declares one organization type (`platform-operator`) and it\n * carries no marker, by construction and by pin. The report could only ever find \"not declared\"\n * and return, so the gate costs nothing and saves two reads during platform boot.\n * - the runtime profile — this reads `organizations` application-wide, and a confined runtime\n * (minion/worker) holds no grant over that table. That is measured, not assumed: on a clean-room\n * PostgreSQL boot the marketing-scrapper minion produced `permission denied for table\n * organizations` on every startup. The application backend still runs the report, so no\n * observation is lost — only the recurring, ignorable error inside an otherwise healthy boot.\n *\n * NON-FATAL, like its two neighbours: a diagnostic must never be why startup fails.\n */\n protected async reportApplicationOwnerOrganization(): Promise<void> {\n if (this.isPlatformMode) return;\n if (!resolveApplicationRuntimeProfileBootAssertions(this.resolvedRuntimeProfile).reportsAdministrativeContinuityFloors) return;\n\n try {\n if (!this.repositoriesRegistryService.getRepository(CoreResourceType.ORGANIZATIONS)) {\n this.logDebug('Skipping the application-owner organization report: no organizations repository is registered');\n return;\n }\n\n const resolver = this.applicationOwnerOrganizationResolver;\n if (!resolver) {\n this.logDebug('Skipping the application-owner organization report: the resolver is not bound');\n return;\n }\n const ownerType = resolver.resolveOwnerOrganizationType();\n if (!ownerType) return; // No marked type: the default shape, and nothing to say about it.\n\n const resolution = await resolver.resolve();\n if (resolution.owner) {\n this.logDebug('Application-owner organization resolved', {\n organizationId: resolution.owner.organizationId,\n organizationType: resolution.owner.organizationType,\n });\n return;\n }\n\n if (resolution.absence === ApplicationOwnerOrganizationAbsence.SEVERAL) {\n this.logger.error(\n 'Several organizations carry the type that declares `ownsApplication`. Exactly one organization may '\n + 'operate the application, and until an operator leaves one the framework refuses to choose — so '\n + 'everything that resolves through the owner organization is currently answering nothing. No engine '\n + 'service-tier door can produce this state; repair the rows directly, leaving exactly one.',\n {\n ownerOrganizationType: ownerType,\n // The ids, not just the count — an operator cannot act on a number, and this is the\n // whole population that needs repairing. The report carries them itself rather than\n // leaving them on the resolver's separate WARN, which a log filter can easily miss.\n organizationIds: resolution.duplicateOrganizationIds ?? [],\n },\n );\n return;\n }\n\n this.logger.warn(\n 'An organization type declares `ownsApplication` and no organization carries it, so this application has '\n + 'no owner organization. On a fresh installation the platform seeds it with the first administrator; on '\n + 'an existing one, promote an ACTIVE organization with `organizations.promoteToOwnerOrganization`.',\n { ownerOrganizationType: ownerType, absence: resolution.absence },\n );\n } catch (error) {\n // See the header: a diagnostic must never be the reason startup fails.\n this.logDebug('Application-owner organization report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * WHO holds privileged access right now, at both scopes — the review's raw material (#202).\n *\n * assurance-control: WILDO.ACCESS.PRIVILEGED_REVIEW — surface the privileged-access population at\n * a moment an operator is present, so a periodic review has an explicitly scoped list to decide\n * over.\n *\n * ## Why it reports the SHAPE and not the roster\n *\n * The roster is what a reviewer needs and a boot log is the wrong place to put it: it would be\n * per-principal lines on every restart, unread, and it would put administrator identities into a\n * log stream that has no reason to hold them. What the log CAN carry is the size and the axes —\n * how many at each scope, which roles confer it, and which tenants could not be read — which is\n * enough to notice that the population moved and to know a review is due. The roster stays one\n * call away in `enumeratePrivilegedAccessPopulation`.\n *\n * ## Why it is not a review\n *\n * Nothing here schedules, decides or records an outcome. The occurrence record is the\n * application's to supply as a declared host artifact\n * (`PRIVILEGED_ACCESS_REVIEW_HOST_RECORD_ARTIFACT_KIND_REF`), because Wildo cannot witness a human\n * review — and a boot line that read as one would be the framework asserting a decision nobody\n * made.\n *\n * NON-FATAL and gated exactly like the two floors above: a confined runtime holds no grant over\n * `users` or `organizations`, and a diagnostic must never be why startup fails.\n */\n protected async reportPrivilegedAccessPopulation(): Promise<void> {\n if (this.isPlatformMode) return;\n if (!resolveApplicationRuntimeProfileBootAssertions(this.resolvedRuntimeProfile).reportsAdministrativeContinuityFloors) return;\n\n try {\n if (!this.repositoriesRegistryService.getRepository(CoreResourceType.USERS)) {\n this.logDebug('Skipping the privileged-access population report: no users repository is registered');\n return;\n }\n const authExecutionContextFactory = this.authExecutionContextFactory;\n if (!authExecutionContextFactory) {\n this.logDebug('Skipping the privileged-access population report: the auth execution-context factory is not bound');\n return;\n }\n\n const population = await enumeratePrivilegedAccessPopulation({\n authExecutionContextFactory,\n repositoriesRegistry: this.repositoriesRegistryService,\n errorBuilder: this.errorBuilder,\n applicationScopeConferringRoles: resolveSuperAdminConferringRoles(this.authorizationsService),\n organizationScopeConferringRoles: resolveOrganizationOwnerConferringRoles(this.authorizationsService),\n // Supplied, never read inside the enumeration — see its `observedAt` doc.\n observedAt: new Date().toISOString(),\n });\n\n this.logDebug('Privileged-access population observed', {\n observedAt: population.observedAt,\n applicationScopeHolderCount: population.applicationScopeHolders.length,\n organizationScopeHolderCount: population.organizationScopeHolders.length,\n applicationScopeConferringRoles: population.applicationScopeConferringRoles,\n organizationScopeConferringRoles: population.organizationScopeConferringRoles,\n });\n\n // WARN and separate, because it is the only part a reader must act on: a tenant the\n // enumeration could not read is absent from the population, and an absent tenant looks\n // exactly like one with no privileged access — the wrong direction to be wrong in.\n if (population.unreadableOrganizationIds.length > 0) {\n this.logger.warn(\n 'The privileged-access enumeration could not read the memberships of some tenants. Those tenants are '\n + 'ABSENT from the population, which is indistinguishable from having no privileged access — treat a '\n + 'review taken now as incomplete for them.',\n { unreadableOrganizationIds: population.unreadableOrganizationIds },\n );\n }\n } catch (error) {\n this.logDebug('Privileged-access population report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * WHICH stored provider credentials sit under a slot name their provider no longer declares (#624).\n *\n * ## What it reports, and why it only reports\n *\n * A credential row is keyed `(owner, connectionRef, secretSlug)` (#1670) and classified here by the `providerRef`\n * that created it, whose secrets contract the slot belongs to; every lookup asks for the provider's\n * secrets-contract KEY, and a row keyed on anything else — the env-var spelling rows carried before\n * the store was keyed on the key, or a spelling a regeneration renamed — is present, enabled,\n * correctly sealed and unreachable. The refusal at read time now says so; this is the half that\n * finds the population before anybody tries to use one.\n *\n * It never repairs. The seal binds the slot name, so the row cannot be renamed, and re-sealing it\n * is a migration machine the project decided not to build (2026-09-12). The remedy is reconnecting,\n * which is a person's act, not a boot step's.\n *\n * ## WARN, counts only, and two lines rather than one\n *\n * WARN: nothing is broken for anyone who has not tried to use the credential, and the connections\n * are recoverable. Counts per provider and slot, never an owner id — an operator acts on \"asana has\n * two organization rows under `ASANA_API_KEY`\", and a boot log has no reason to hold tenant or\n * person identifiers. A provider that is not registered at all is its OWN line: its remedy is the\n * provider module, and reconnecting to a provider the application no longer carries is impossible.\n *\n * NON-FATAL and gated like the reports above: a confined runtime holds no grant over these tables,\n * and a diagnostic must never be why startup fails.\n */\n protected async reportStoredProviderCredentialSlots(systemAccess: SystemAccessBackendService | undefined): Promise<void> {\n if (this.isPlatformMode) return;\n if (!resolveApplicationRuntimeProfileBootAssertions(this.resolvedRuntimeProfile).reportsStoredProviderCredentialSlots) return;\n\n try {\n if (!systemAccess) {\n this.logDebug('Skipping the stored provider credential slot report: no system access service is bound');\n return;\n }\n\n const report = await measureStoredProviderCredentialSlots({\n systemAccess,\n registry: this.externalProvidersRegistryService,\n isReadable: (resourceType) => Boolean(this.repositoriesRegistryService.getRepository(resourceType)),\n });\n\n if (report.retiredSlots.length > 0) {\n this.logger.warn(\n 'Stored provider credentials sit under a slot name their provider no longer declares, so no lookup under '\n + 'the current contract reaches them: a call that asks to act as one of those owners is refused rather than '\n + 'served from them. They cannot be renamed — the seal binds the '\n + 'slot name — and nothing repairs them automatically. Each affected organization or person must '\n + 'reconnect the account (or re-enter the credential), which stores it under the current slot. '\n + 'Reconnecting does not remove the retired row: it stays behind as inert residue, and this line keeps '\n + 'counting it until the row is deleted.',\n {\n retiredSlotRowCount: report.retiredSlots.reduce((total, finding) => total + finding.rowCount, 0),\n retiredSlots: report.retiredSlots,\n inspectedRowCount: report.inspectedRowCount,\n },\n );\n }\n\n if (report.unregisteredProviders.length > 0) {\n this.logger.warn(\n 'Stored provider credentials belong to providers this runtime does not register at all, so they cannot be '\n + 'judged or used. Restore the provider module if the integration is still wanted; otherwise the rows are '\n + 'residue of a removed provider.',\n {\n unregisteredProviderRowCount: report.unregisteredProviders.reduce((total, finding) => total + finding.rowCount, 0),\n unregisteredProviders: report.unregisteredProviders,\n inspectedRowCount: report.inspectedRowCount,\n },\n );\n }\n\n if (report.retiredSlots.length === 0 && report.unregisteredProviders.length === 0) {\n this.logDebug('Every stored provider credential is under a slot its provider currently declares', {\n inspectedRowCount: report.inspectedRowCount,\n });\n }\n } catch (error) {\n this.logDebug('Stored provider credential slot report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * WHICH of the application's own resources have never been asked whether they hold personal data.\n *\n * ## Why this reports and does not refuse — the decision, not an omission\n *\n * Issue #93 asked whether a resource holding personal data should be REQUIRED to declare it, and\n * the evidence for requiring it was strong. Measured across two applications, a declaration gets\n * made if and only if the framework refuses to start without it: `exportSubject` is fail-closed at\n * registration and was declared on 10 of 12 resources, while `retentionPolicy` and\n * `.impersonalizeWith()` are unenforced and were declared on 1 and 0.\n *\n * Paul decided against refusing: a hard constraint on every author, for every resource, forever is\n * too strict, and it is the shape `application-creation-directive.md` warns about — the system must\n * work first, with protection arriving as a judge-style guard rather than a refusal wired into the\n * mechanism. So the log line is the whole enforcement here, and the half that actually produces\n * declarations is the framework knowledge that teaches an author to write one while authoring the\n * resource, where it costs a line.\n *\n * ## WARN, and the wording matters more than the level\n *\n * This reports \"unanswered\", never \"undeclared personal data\". Most resources genuinely hold none,\n * and a report that implied otherwise would be wrong about the majority of its own findings — which\n * is precisely how a diagnostic channel trains its readers to skim. ERROR is reserved for the two\n * administrative floors above, where something IS broken.\n *\n * ## Application resources only\n *\n * The engine declares its own posture across ~85 resources and an application author cannot change\n * any of them. `applicationResourceTypes` comes from the registry, which records the split at the\n * one point where the app and core factory maps are still distinguishable.\n */\n private reportApplicationPersonalDataDeclarations(): void {\n try {\n const registry = this.resourcesRegistryService?.getResourcesRegistry();\n if (!registry) {\n this.logDebug('Skipping the personal-data declaration report: the resources registry is not available');\n return;\n }\n\n const unanswered = collectApplicationResourcesWithNoPersonalDataDeclaration({\n resourceConfigurations: registry.resourceConfigurations as unknown as Record<string, PersonalDataDeclarationSubject>,\n applicationResourceTypes: registry.applicationResourceTypes,\n });\n\n if (unanswered.length === 0) {\n this.logDebug('Every application resource has answered the personal-data question', {\n applicationResourceCount: registry.applicationResourceTypes.length,\n });\n return;\n }\n\n this.logger.warn(\n 'Application resources have said NOTHING about whether their rows are about people. This is '\n + 'not a claim that they hold personal data — most resources do not — it is that the question '\n + 'is unanswered, so a generated privacy notice can say nothing about them and an erasure '\n + 'request has no instruction for them. Answer it on the resource configuration with any of: '\n + '`retentionPolicy` (RETAIN_ONLY is the checked way to say \"holds no personal data of its '\n + 'own\"), `dataSubjectPolicy`, `systemAccessPolicy.exportSubject`, or a `.dataCategories()` '\n + 'declaration on the fields that hold it.',\n {\n unansweredResourceCount: unanswered.length,\n applicationResourceCount: registry.applicationResourceTypes.length,\n unansweredResources: unanswered,\n },\n );\n } catch (error) {\n // A diagnostic must never be the reason startup fails — the same contract as the two floors.\n this.logDebug('Personal-data declaration report could not run', projectCaughtErrorLogFields(error));\n }\n }\n\n /**\n * Validate that all components are properly initialized\n */\n private async validateInitialization(options: { headlessMode?: boolean } = {}): Promise<void> {\n this.logDebug('Validating application initialization...');\n\n try {\n // Validate app config is accessible\n if (!this.isPlatformMode) {\n const config = this.appConfigService.config;\n if (!config) {\n const error = this.errorBuilder.buildError(\n ErrorType.CONFIGURATION,\n undefined,\n {customMessageReference: ErrorCustomMessageReference.START_APPLICATION_CONFIGURATION_FAILED}\n );\n throw error;\n }\n }\n\n // Validate resources registry is accessible\n const registry = this.resourcesRegistryService.getResourcesRegistry();\n if (!registry) {\n const error = this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n {customMessageReference: ErrorCustomMessageReference.START_APPLICATION_INITIALIZATION_FAILED}\n );\n throw error;\n }\n\n // Validate repositories registry is accessible\n // const repositoriesDebugInfo = this.repositoriesRegistryService.getDebugInfo();\n // if (!repositoriesDebugInfo.isInitialized) {\n // throw new Error('Repositories registry is not initialized');\n // }\n\n // Validate services registry is accessible\n // const servicesDebugInfo = this.servicesRegistryService.getDebugInfo();\n // if (!servicesDebugInfo.isInitialized) {\n // throw new Error('Services registry is not initialized');\n // }\n\n // Validate controllers registry is accessible\n // const controllersDebugInfo = this.controllersRegistryService.getDebugInfo();\n // if (!controllersDebugInfo.isInitialized) {\n // throw new Error('Controllers registry is not initialized');\n // }\n\n // // Validate HTTP server is running\n // if (!this.httpServerService.isRunning()) {\n // throw new Error('HTTP server is not running');\n // }\n\n const serverInfo = options.headlessMode\n ? undefined\n : this.httpServerService.getServerInfo();\n\n // this.logDebug('Application initialization validation successful', {\n // appName: config.appIdentity.appName,\n // environment: process.env.APPLICATION_ENV,\n // resourcesCount: Object.keys(registry.resourceConfigurations).length,\n // repositoriesCount: repositoriesDebugInfo.repositoryCount,\n // repositoriesOperationPaths: repositoriesDebugInfo.operationPathsCount,\n // servicesCount: servicesDebugInfo.serviceCount,\n // servicesOperationPaths: servicesDebugInfo.operationPathsCount,\n // controllersCount: controllersDebugInfo.controllerCount,\n // controllersOperationPaths: controllersDebugInfo.operationPathsCount,\n // totalRoutes: controllersDebugInfo.totalRoutes,\n // httpServerRunning: this.httpServerService.isRunning(),\n // serverHost: serverInfo?.host,\n // serverPort: serverInfo?.port\n // });\n\n } catch (error) {\n // Validation failure ownership stays with the terminal runtime host.\n throw error;\n }\n }\n\n /**\n * Ensure the application is initialized before operations\n */\n private ensureInitialized(): void {\n if (!this.isInitialized) {\n const error = this.errorBuilder.buildError(\n ErrorType.INTERNAL,\n undefined,\n { customMessageReference: ErrorCustomMessageReference.START_APPLICATION_STARTUP_FAILED }\n );\n throw error;\n }\n }\n\n protected shouldInitializeHttpServer(options: { headlessMode?: boolean }): boolean {\n return !this.isPlatformMode && !options.headlessMode;\n }\n\n protected shouldSyncCronJobs(options: { skipCronSync?: boolean }): boolean {\n return !this.isPlatformMode && !options.skipCronSync;\n }\n\n private rebindServicesRegistryForRuntime(container: any, registry: ServicesRegistryHandlerBackendService): void {\n if (!container || typeof container.rebind !== 'function') {\n return;\n }\n container.rebind(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService).toConstantValue(registry);\n }\n}\n\n/**\n * `listAsSystem` returns either a bare array or a paginated envelope depending on whether the caller\n * asked for pagination. The erasure effect's reads never paginate, but narrowing by CAST would be a\n * lie that survives until the day someone adds a pagination argument — normalise instead.\n */\nfunction normalizeSystemListResult<T>(result: T[] | { data?: T[]; items?: T[] }): T[] {\n if (Array.isArray(result)) return result;\n return result?.data ?? result?.items ?? [];\n}\n\n"]}