npm - @wildo-ai/saas-frontend-lib - Versions diffs - 1.1.10 → 1.1.11 - Mend

@wildo-ai/saas-frontend-lib 1.1.10 → 1.1.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2177) hide show

package/dist/esm/core/security/UserOrgsContext.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UserOrgsContext.js","sourceRoot":"","sources":["../../../../../src/core/security/UserOrgsContext.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,aAAa,EAAE,QAAQ,EAAa,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC3G,OAAO,EAGL,gBAAgB,EAChB,kCAAkC,EAClC,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EAIrB,WAAW,EACX,wBAAwB,GAEzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,6CAA6C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAI3G,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AAEzF,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AACxE,MAAM,QAAQ,GAAiE,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;AACrH,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AA2D1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmD,aAAa,CAAkC,SAAS,CAAC,CAAC;AAEzI,MAAM,CAAC,MAAM,gBAAgB,GAAsC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IAClF,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAE/B,+BAA+B;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,MAAM,EAAE,UAAU,EAClB,UAAU,EACV,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,GAAG,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,4BAA4B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC/D,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IAE7D,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,gBAAgB,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IACrD,yEAAyE;IACzE,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,oBAAoB,GAAG,MAAM,CAAuC,IAAI,CAAC,CAAC;IAEhF,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAE3D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAwB,EAAE,CAAC,CAAC;IAE9E,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAGpC,IAAI,CAAC,CAAC;IAEhB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAIjE;;;;;;;;;OASG;IACH,MAAM,8BAA8B,GAAG,CACrC,uBAA8E,EACrD,EAAE;QAC3B,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,uBAAuB,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,+BAA+B,EAAE,uBAAuB,CAAC,mBAAmB,IAAI,IAAI;YACpF,+BAA+B,EAAE;gBAC/B,QAAQ,EAAE,uBAAuB,CAAC,QAAQ;gBAC1C,MAAM,EAAE,uBAAuB,CAAC,MAAM;gBACtC,UAAU,EAAE,uBAAuB,CAAC,UAAU;gBAC9C,UAAU,EAAE,uBAAuB,CAAC,UAAU;aAC/C;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,sBAAsB,GAAG,WAAW,CAAC,CACzC,WAAkD,EAClD,uBAAmE,EAC7D,EAAE;QACR,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;gBAC5C,mBAAmB,EAAE,IAAI;gBACzB,+BAA+B,EAAE,IAAI;gBACrC,mBAAmB,EAAE,IAAI;gBACzB,+BAA+B,EAAE,IAAI;gBACrC,wBAAwB,EAAE,IAAI;gBAC9B,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;YAC5C,GAAG,CAAC,WAAW,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnH,GAAG,8BAA8B,CAAC,uBAAuB,CAAC;YAC1D,GAAG,CAAC,WAAW,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,WAAW,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,kBAAkB,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IACvD,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,MAAwB,EAAQ,EAAE;QACvE,MAAM,cAAc,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAClD,IAAI,cAAc,KAAK,IAAI;YAAE,OAAO;QACpC,kBAAkB,CAAC,OAAO,GAAG,IAAI,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACX,MAAM,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC;IACtC,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,cAAc,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAClD,IAAI,cAAc,KAAK,WAAW;YAAE,OAAO;QAC3C,IAAI,cAAc,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACpD;;;;;;;;eAQG;YACH,iBAAiB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YACnC,iBAAiB,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,kBAAkB,CAAC,OAAO,GAAG,WAAW,CAAC;YACzC,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAEjH,MAAM,wBAAwB,GAAG,OAAO,CAAuC,GAAG,EAAE;QAClF,OAAO,iBAAiB,CAAC,iBAAiB,CAAC;YACzC,MAAM,EAAE,QAAQ,CAAC,aAAa;YAC9B,cAAc,EAAE,QAAQ,CAAC,qBAAqB;YAC9C,aAAa,EAAE,QAAQ,CAAC,oBAAoB;YAC5C,eAAe,EAAE,QAAQ,CAAC,sBAAsB;SACjD,CAAC,CAAC;IACL,CAAC,EAAE;QACD,QAAQ,CAAC,oBAAoB;QAC7B,QAAQ,CAAC,sBAAsB;QAC/B,QAAQ,CAAC,qBAAqB;QAC9B,QAAQ,CAAC,aAAa;KACvB,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,CACnC,WAA+B,EAC/B,uBAAmE,EAC7D,EAAE;QACR,qCAAqC;QACrC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,8BAA8B,GAAG,uBAAuB,KAAK,SAAS;YAC1E,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,qBAAqB;gBACrB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,WAAW;gBAC/F,CAAC,CAAC,SAAS,CAAC;QAEhB,yDAAyD;QACzD,sBAAsB,CACpB,WAAW,EACX,8BAA8B,CAC/B,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,CAAC,CAAC,CAAC;IAEnE;;;OAGG;IACH,MAAM,2BAA2B,GAAG,CAClC,WAAwB,EACxB,iBAAwC,EACX,EAAE;QAC/B,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAa,CAAC;QAE1D,kEAAkE;QAClE,qDAAqD;QACrD,MAAM,wBAAwB,GAA6B,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE1D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,wBAAwB,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAa,CAAC;QAC7F,CAAC;QAED,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,wBAAwB;SACxC,CAAC;IACJ,CAAC,CAAC;IAEF;;OAEG;IACH,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAwB,EAGlE,EAAE;QACH,MAAM,cAAc,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE7D,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;YAC1D,CAAC,CAAC,YAAY,CAAC,iBAAiB,EAAE;YAClC,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,WAAW,GAAG,WAAW;YAC7B,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC;YACrE,CAAC,CAAC,cAAc,CAAC;QAEnB,QAAQ,CAAC,uBAAuB,EAAE;YAChC,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,eAAe,EAAE,WAAW,CAAC,MAAM;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;SACnD,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAA0B,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,mBAAmB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC5F,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;gBACpD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,qFAAqF;YACrF,MAAM,UAAU,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;YAEpE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBACtD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,MAAM,0BAA0B,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,UAAU,CAAC,CAAC;YAErH;;;;;;;;;;;;;;;;;;;;;;;;;eAyBG;YACH,MAAM,6BAA6B,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;YACjH,MAAM,6BAA6B,GAAG,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;YAEjG,IAAI,CAAC,6BAA6B,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;YAClH,CAAC;YAED,MAAM,oCAAoC,GAAG,6BAA6B;gBACxE,CAAC,CAAC,kCAAkC,CAAC,kCAAkC,CAAC,6BAA6B,CAAC;gBACtG,CAAC,CAAC,IAAI,CAAC;YAET,MAAM,4BAA4B,GAAG,KAAK,EACxC,cAAsB,EACmC,EAAE;gBAC3D,IAAI,CAAC,oCAAoC;oBAAE,OAAO,SAAS,CAAC;gBAC5D,IAAI,CAAC;oBACH,OAAO,MAAM,WAAW,CACtB,oCAAoC,EACpC,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,EAAE,CAC7C,IAAI,SAAS,CAAC;gBACjB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;oBACnF,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAe,EAAE,EAAE;gBAC5D,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBAC3C,WAAW,CACT,0BAA0B,EAC1B,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC1E,4BAA4B,CAAC,UAAU,CAAC,cAAc,CAAC;qBACxD,CAAC,CAAC;oBAEH,IAAI,CAAC,GAAG;wBAAE,OAAO,IAAI,CAAC;oBACtB,sFAAsF;oBACtF,uFAAuF;oBACvF,sFAAsF;oBACtF,qFAAqF;oBACrF,8BAA8B;oBAC9B,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACrD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;oBAClG,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,iBAAiB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAA8B,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC;QAClG,CAAC;QAED,yCAAyC;QACzC,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACrD,MAAM,aAAa,GAAG,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC;YACrF,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;QAEtC,2CAA2C;QAC3C,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAExF,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACpC,4BAA4B,CAAC,aAAa,CAAC,CAAC;QAC5C,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAEpC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC,CAAC;QACxH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC,EAAE,CAAC,4BAA4B,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1F;;OAEG;IACH,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAmB,EAAoB,EAAE;QACrF,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAEnC,kCAAkC;QAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAE5E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEnF,MAAM,aAAa,GAAG,2BAA2B,CAAC,cAAc,CAAC,CAAC;QAElE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,MAAM,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CAC/D,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;YACrD,EAAE,CAAC,eAAe,KAAK,IAAI;YAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;gBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE;YACD,EAAE,CAAC,UAAU,KAAK,qBAAqB,CAAC,OAAO,CAChD,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC;QAEnG,MAAM,oBAAoB,GAA2B,EAAE,CAAC;QAExD,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,gBAAgB,CAAsB,WAAW,CAAC,CAAC;gBACnE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,oBAAoB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC/C,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,MAAM,WAAW,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,aAAa,CAAC,CAAC;QACzG,MAAM,WAAW,GAAG,MAAM,WAAW,CAAc,WAAW,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,CAAC,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACxE,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEpG,oBAAoB;QACpB,OAAO,CAAC,WAAW,CAAC,CAAC;QAErB,gCAAgC;QAChC,+EAA+E;QAC/E,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAElF,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,mBAAmB,GAAG,aAAa;gBACvC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,aAAa,CAAC;gBAC9E,CAAC,CAAC,IAAI,CAAC;YACT,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC3C,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,iBAAiB,EAAE,gBAAgB;SACpC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,6EAA6E;IAC7E,SAAS,CAAC,GAAG,EAAE;QACb,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,OAAO,GAAG,EAAE;YACV,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,IAAI,oBAAoB,CAAC,OAAO,EAAE,CAAC;gBACjC,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC3C,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACtC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;;;;;;;OAUG;IACH,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,IAAsB,EAAE;QAC9D,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAEhD,+EAA+E;QAC/E,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YACrD,QAAQ,CAAC,gDAAgD,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,gEAAgE;QAChE,uEAAuE;QACvE,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBAEvD,IAAI,QAAQ,EAAE,CAAC;oBACb,mBAAmB,EAAE,CAAC;oBAEtB,mFAAmF;oBACnF,6EAA6E;oBAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;wBAC7C,oEAAoE;wBACpE,oEAAoE;wBACpE,oEAAoE;wBACpE,0DAA0D;wBAC1D,mEAAmE;wBACnE,2DAA2D;wBAC3D,mEAAmE;wBACnE,sEAAsE;wBACtE,wEAAwE;wBACxE,2EAA2E;wBAC3E,qEAAqE;wBACrE,2CAA2C;wBAC3C,MAAM,mBAAmB,GAAG,YAAY,CAAC,cAAc,EAAE,IAAI,WAAW,CAAC;wBACzE,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC;oBAC1E,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,+GAA+G,CAAC,CAAC;oBAC7H,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;gBAC7C,CAAC;gBAED,OAAO,QAAQ,CAAC;YAElB,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,yEAAyE;gBACzE,uEAAuE;gBACvE,kEAAkE;gBAClE,qEAAqE;gBACrE,sEAAsE;gBACtE,0EAA0E;gBAC1E,kCAAkC;gBAClC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAE1E,IAAI,oBAAoB,EAAE,CAAC;oBACzB,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,8CAA8C,CAAC;oBACtF,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;wBACvE,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAC3B,mBAAmB,EAAE,CAAC;oBACtB,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,yEAAyE;gBACzE,sEAAsE;gBACtE,mEAAmE;gBACnE,yEAAyE;gBACzE,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrC,OAAO,IAAI,CAAC,CAAC;oBACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,2BAA2B,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAChD,0BAA0B,CAC3B,CAAC;oBACF,MAAM,CAAC,IAAI,CAAC,sFAAsF,EAAE;wBAClG,OAAO;wBACP,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;wBAC/B,IAAI,EAAE,KAAK,EAAE,IAAI;qBAClB,CAAC,CAAC;oBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;wBAClC,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC5D,CAAC,CAAC,CAAC;oBACH,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC9D,mBAAmB,CAAC,KAAK,CAAC,CAAC;wBAC3B,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClD,QAAQ,CAAC,wDAAwD,EAAE;wBACjE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;oBAC3C,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,uEAAuE;gBACvE,wEAAwE;gBACxE,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,4BAA4B,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;oBAChF,KAAK,EAAE,YAAY;oBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI;iBACnC,CAAC,CAAC;gBAEH,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;gBAC3C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC,EAAE;QACD,kBAAkB;QAClB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI;QACJ,UAAU;QACV,mBAAmB;QACnB,mBAAmB;QACnB,gBAAgB;QAChB,YAAY;KACb,CAAC,CAAC;IAEH;;OAEG;IACH,MAAM,oBAAoB,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACjE,qDAAqD;QACrD,MAAM,WAAW,GAAG,IAAI,EAAE,mBAAmB,IAAI,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,wCAAwC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,0BAA0B,EAAE,EAAE,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9E,mCAAmC;QACnC,MAAM,iBAAiB,CAAC,IAAK,CAAC,CAAC;IACjC,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE9B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,GAAG,qBAAqB;YAC/C,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC;YAClF,CAAC,CAAC,IAAI,CAAC;QAET,sBAAsB,CACpB,IAAI,CAAC,mBAAmB,EACxB,mBAAmB,EAAE,WAAW,CACjC,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,CAAC,cAAsB,EAAQ,EAAE;QAC1E,4DAA4D;QAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QAED,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;QAErD,0CAA0C;QAC1C,IAAI,sBAAsB,KAAK,cAAc,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,CAAC,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACjH,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC,EAAE,CAAC,aAAa,EAAE,qBAAqB,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,GAA+B,EAAE;QAC1E,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,qBAAqB,CAAC,IAAI,IAAI,CAAC;IAC1E,CAAC,EAAE,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC,CAAC;IAE3C;;OAEG;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,GAAuB,EAAE;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,2GAA2G;IAC3G,iEAAiE;IACjE,MAAM,8BAA8B,GAAG,QAAQ,CAAC,yBAAyB,CAAC;IAC1E,MAAM,qBAAqB,GAAG,WAAW,CAAC,KAAK,EAAE,eAA0C,EAAwB,EAAE;QACnH,MAAM,SAAS,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,UAAU,CAAC,IAAI,CACxG,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,MAAM;eACxE,SAAS,CAAC,kBAAkB,KAAK,IAAI;eACrC,SAAS,CAAC,eAAe,KAAK,IAAI;eAClC,CACD,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;mBAC5D,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACjF,CACJ,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;QACzH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,kCAAkC,CAAC,kCAAkC,CAAC,SAAS,CAAC,EAChF;YACE,mGAAmG;YACnG,oGAAoG;YACpG,+FAA+F;YAC/F,gGAAgG;YAChG,oBAAoB,EAAE,8BAA8B,EAAE;YACtD,WAAW,EAAE;gBACX,4FAA4F;gBAC5F,OAAO,EAAE,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,eAAe,CAAC,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,EAAE;aACxG;SACF,CACF,CAAC;QACF,MAAM,aAAa,GAAG,OAAO,EAAE,OAAO,CAAC;QACvC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QAED,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,8FAA8F;QAC9F,0FAA0F;QAC1F,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ;YAC5B,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAwC,EAAE;YACjJ,CAAC,CAAC,QAAQ,CAAC,CAAC;QACd,gGAAgG;QAChG,kGAAkG;QAClG,qFAAqF;QACrF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACpD,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1F,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC,EAAE,CAAC,8BAA8B,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAExG;;OAEG;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAS,EAAE;QACpC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAE3F,yFAAyF;QACzF,iBAAiB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAE/C,4BAA4B;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACnC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAE7B,4BAA4B;QAC5B,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QAClC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEhC,0DAA0D;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE,UAAU,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAE5H,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,2CAA2C;QAC3C,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;YACvC,OAAO;QACT,CAAC;QAED,+BAA+B;QAC/B,IAAI,iBAAiB,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,+CAA+C,EAAE;YACxD,QAAQ,EAAE,CAAC,CAAC,WAAW;YACvB,aAAa,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO;SAC1C,CAAC,CAAC;QAEH,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;QACvC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEjC,6CAA6C;QAC7C,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/B,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5F,gDAAgD;IAChD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAClD,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YAClD,uFAAuF;YACvF,iBAAiB,CAAC,mBAAmB,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;YACnC,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC7B,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QACpC,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAErH,MAAM,KAAK,GAAG,OAAO,CAAsB,GAAG,EAAE,CAAC,CAAC;QAChD,0DAA0D;QAC1D,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QAEd,uEAAuE;QACvE,mBAAmB;QACnB,sBAAsB;QAEtB,YAAY;QACZ,IAAI;QAEJ,oBAAoB;QACpB,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QAExB,yCAAyC;QACzC,OAAO;QAEP,0BAA0B;QAC1B,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QAEpB,iBAAiB;QACjB,UAAU;QACV,qBAAqB;KACtB,CAAC,EAAE;QACF,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QACd,mBAAmB;QACnB,sBAAsB;QACtB,IAAI;QACJ,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QACxB,OAAO;QACP,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QACpB,UAAU;QACV,qBAAqB;KACtB,CAAC,CAAC;IAEH,OAAO,KAAC,eAAe,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA4B,CAAC;AACvF,CAAC,CAAC","sourcesContent":["import React, { createContext, useState, ReactNode, useMemo, useEffect, useCallback, useRef } from 'react';\nimport {\n UserContext,\n OrganizationContext,\n CoreResourceType,\n ResourcesConfig_OperationPathUtils,\n CoreResourceOperation,\n ResourceOperationVariantType,\n OPERATION_VARIANT_KEY,\n ExecutionContext_InitiatorIds,\n UserPrivacy,\n UserPreferences,\n SessionType,\n normalizeConsentPurposes,\n type ConsentPurpose,\n} from '@wildo-ai/saas-models';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useEventBus } from '~wildo-frontend-lib/core/events/useEventBus';\nimport { FrontendEvents, SessionEndReason } from '~wildo-frontend-lib/core/events/events.frontend.schemas';\nimport {\n EffectivePermissions,\n} from './security.frontend.schemas';\nimport { useAuthSession } from './useAuthSession';\nimport { AuthSessionUtils } from './auth-session.utils';\nimport { isTransientBackendFailure } from '~wildo-frontend-lib/core/requests/auth-refresh-resilience.frontend';\nimport { decodeJwtPayload } from './jwt.frontend.utils';\nimport { useAppScope } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { useAppScopeInternal } from '~wildo-frontend-lib/core/scope/AppScopeContext';\nimport { ScopeUtilsService } from '~wildo-frontend-lib/core/scope/scope.utils.frontend.service';\nimport { findDefaultApiReadOperation } from './route-organization-access.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\nconst logDebug: (message: string, context?: Record<string, unknown>) => void = logger.debugByType('UserOrgsContext');\nlogger.setDebugTypeLogging('UserOrgsContext', false);\n\n/*\n Session-restore retry backoff bounds (transient backend failures only).\n \n On RELOAD, a backend that is recompiling/restarting (dev) or briefly\n * unavailable (prod) makes the session-restore fetch fail transiently. Rather\n * than force a logout — which clears the shared `__wildo_refresh` cookie and\n * drops the user to the login screen — restore preserves the session and\n * retries with exponential backoff until the backend returns. Genuine auth/authz\n * and non-network errors do NOT retry (see `restoreSession`). Backoff caps so a\n * sustained outage settles at one attempt per {@link RESTORE_RETRY_MAX_DELAY_MS}.\n /\nconst RESTORE_RETRY_BASE_DELAY_MS = 1_000;\nconst RESTORE_RETRY_MAX_DELAY_MS = 30_000;\n\n/\n User Organizations Context\n * Manages user data, organizations, permissions, and preferences\n * Consumes AuthSessionContext for authentication state\n /\n\nexport interface UserOrgsContextType {\n // Re-exported from AuthSession for backward compatibility\n auth: ReturnType<typeof useAuthSession>['auth'];\n identifyByEmail: ReturnType<typeof useAuthSession>['identifyByEmail'];\n authenticateWithPassword: ReturnType<typeof useAuthSession>['authenticateWithPassword'];\n authenticate: ReturnType<typeof useAuthSession>['authenticate'];\n getSessionState: ReturnType<typeof useAuthSession>['getSessionState'];\n isAuthenticated: ReturnType<typeof useAuthSession>['isAuthenticated'];\n logout: () => void;\n restoreSession: () => Promise<boolean>;\n\n // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n initiateOAuth2Login: ReturnType<typeof useAuthSession>['initiateOAuth2Login'];\n handleAuthCodeExchange: ReturnType<typeof useAuthSession>['handleAuthCodeExchange'];\n\n // User data\n user: UserContext \| null;\n\n // Organization data\n organizations: OrganizationContext[];\n currentOrganizationId: string \| null;\n permissions: EffectivePermissions \| null;\n primaryScopeInitiatorIds: ExecutionContext_InitiatorIds \| null;\n\n // Privacy (only preference managed here, others are in their respective contexts)\n privacy: UserPrivacy \| null;\n\n // Organization management\n setCurrentOrganization: (organizationId: string) => void;\n getCurrentOrganization: () => OrganizationContext \| null;\n refreshOrganizations: () => Promise<void>;\n\n // Privacy getter\n getPrivacy: () => UserPrivacy \| null;\n\n /\n Record the signed-in person's consent decision: exactly the purposes they granted (#534).\n \n The argument is the WHOLE granted set, never a delta — a purpose left out is a purpose not granted,\n * so an unticked box is a withdrawal rather than \"no change\". The write always carries a decision\n * claim, which is what lets \"grant nothing\" be recorded as a decision instead of reading as a person\n * who was never asked; the recorded instant is the server's (`buildConsentDecisionPatch`).\n \n Resolves with the stored privacy block once it is in state, so a caller gating on consent (the\n * consent gate) sees the new decision on the next render. Rejects when the application mounts no\n * self-preferences UPDATE door or the write fails — a consent surface must say it could not save,\n * never behave as though it had.\n /\n recordConsentDecision: (grantedPurposes: readonly ConsentPurpose[]) => Promise<UserPrivacy>;\n}\n\n/\n UserOrgs Context\n * Exported for use in separate hook file (Fast Refresh compatibility)\n * @internal - Use useUserOrgs() hook instead of accessing this directly\n /\nexport const UserOrgsContext: React.Context<UserOrgsContextType \| undefined> = createContext<UserOrgsContextType \| undefined>(undefined);\n\nexport const UserOrgsProvider: React.FC<{ children: ReactNode }> = ({ children }) => {\n const { doOperation, registry } = useResourceRegistry();\n const { emit } = useEventBus();\n\n // Consume auth session context\n const authSession = useAuthSession();\n const {\n auth,\n tokenStorage,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout: authLogout,\n endSession,\n getSessionEstablishment,\n getSessionEndReason,\n initiateOAuth2Login,\n handleAuthCodeExchange,\n markSessionRestored,\n setSessionRestoring,\n connectWebSocket,\n } = authSession;\n const appScope = useAppScope();\n const { commitOrganizationScopeValue } = useAppScopeInternal();\n const currentOrganizationId = appScope.currentOrganizationId;\n\n const hasInitializedRef = useRef(false);\n const previousTokenRef = useRef<string \| null>(null);\n // Restore-retry lifecycle: `restoreAbortRef` flips true on unmount so an\n // in-flight backoff loop bails instead of touching state on a dead component;\n // `restoreRetryTimerRef` holds the pending backoff timer for cleanup.\n const restoreAbortRef = useRef(false);\n const restoreRetryTimerRef = useRef<ReturnType<typeof setTimeout> \| null>(null);\n\n const [user, setUser] = useState<UserContext \| null>(null);\n\n const [organizations, setOrganizations] = useState<OrganizationContext[]>([]);\n\n const [permissions, setPermissions] = useState<{\n appLevel: string[];\n organizations: Record<string, string[]>;\n } \| null>(null);\n\n const [privacy, setPrivacy] = useState<UserPrivacy \| null>(null);\n\n type PreferencesPayload = Pick<UserPreferences, 'languagePreferences' \| 'regional' \| 'ui' \| 'notifications' \| 'privacy'>;\n\n /\n The TENANT's half of the payload, derived from its preferences record rather than passed\n * alongside it (#410).\n \n The organization contributes two things to `I18nContext` — its language policy and its regional\n * defaults — and they are forwarded together because they come from one record. An earlier shape\n * took the language block as its own argument, and when the regional half was added every call\n * site would have had to remember to forward a second one: three sites, one obligation each, and\n * a fourth site tomorrow that forwards neither. Passing the record makes forgetting impossible.\n /\n const organizationPreferencesPayload = (\n organizationPreferences: OrganizationContext['preferences'] \| null \| undefined,\n ): Record<string, unknown> => {\n if (organizationPreferences === undefined) {\n return {};\n }\n if (organizationPreferences === null) {\n return { organizationLanguagePreferences: null, organizationRegionalPreferences: null };\n }\n return {\n organizationLanguagePreferences: organizationPreferences.languagePreferences ?? null,\n organizationRegionalPreferences: {\n timezone: organizationPreferences.timezone,\n locale: organizationPreferences.locale,\n dateFormat: organizationPreferences.dateFormat,\n timeFormat: organizationPreferences.timeFormat,\n },\n };\n };\n\n const emitPreferencesChanged = useCallback((\n preferences: PreferencesPayload \| null \| undefined,\n organizationPreferences?: OrganizationContext['preferences'] \| null,\n ): void => {\n if (preferences === null) {\n emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n languagePreferences: null,\n organizationLanguagePreferences: null,\n regionalPreferences: null,\n organizationRegionalPreferences: null,\n notificationsPreferences: null,\n uiPreferences: null,\n privacy: null,\n });\n return;\n }\n\n emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n ...(preferences?.languagePreferences !== undefined ? { languagePreferences: preferences.languagePreferences } : {}),\n ...organizationPreferencesPayload(organizationPreferences),\n ...(preferences?.regional !== undefined ? { regionalPreferences: preferences.regional } : {}),\n ...(preferences?.notifications !== undefined ? { notificationsPreferences: preferences.notifications } : {}),\n ...(preferences?.ui !== undefined ? { uiPreferences: preferences.ui } : {}),\n ...(preferences?.privacy !== undefined ? { privacy: preferences.privacy } : {}),\n });\n }, [emit]);\n\n /\n * `USER_LOGIN` / `USER_LOGOUT` — announced HERE, once per transition of the known person (#1977).\n \n Nothing emitted them before, so every listener — error-report attribution, analytics identify and\n * reset, the sign-in and sign-out analytics events — was dead code that read as if sign-in were\n * observed. This is the one place every sign-in method and every way a session ends converge: each\n * authentication stores a token, the auto-load effect below restores the user from it, and every\n * sign-out, refused refresh, failed restore and cross-tab sign-out clears the token, which clears the\n * user. Emitting at each auth method instead would be a dozen call sites, and the next method added\n * would be the one that forgot. Declared BEFORE the preferences effect, because effects run in\n * declaration order and a person's arrival must precede their preferences.\n \n The id last announced is the guard, so a re-render, a preferences write that replaces the user\n * object, or StrictMode re-running an effect announces nothing, and a direct switch from one person to\n * another announces the first one's departure before the second one's arrival. HOW the session began\n * and WHY it ended are recorded by `AuthSessionProvider`, the only code that knows, and read at the\n * moment of announcing.\n \n A DEPARTURE is announced by the two places that clear the user, BEFORE they publish `privacy: null`:\n * a listener that must act while the person's consent still holds (the sign-out analytics event, sent\n * before the destinations are reset) needs the announcement first, and the consent-based providers\n * stop on the `privacy: null` that follows. The effect announces ARRIVALS, and a departure only as a\n * backstop for a path that cleared the user without announcing. An unmount announces nothing: the\n * provider going away is not the person signing out.\n /\n const announcedUserIdRef = useRef<string \| null>(null);\n const announceDeparture = useCallback((reason: SessionEndReason): void => {\n const departedUserId = announcedUserIdRef.current;\n if (departedUserId === null) return;\n announcedUserIdRef.current = null;\n emit(FrontendEvents.USER_LOGOUT, { userId: departedUserId, reason });\n }, [emit]);\n const knownUserId = user?._id ?? null;\n useEffect(() => {\n const previousUserId = announcedUserIdRef.current;\n if (previousUserId === knownUserId) return;\n if (previousUserId !== null && knownUserId !== null) {\n /\n * One person REPLACED by another with no sign-out between them. Believed unreachable today: a sign-in\n * while someone is loaded sets `isRestoringSession` with `hasInitializedRef` already true, so the\n * auto-load effect below skips it, and `restoreSession` returns early while a user is loaded. Handled\n * anyway, because the consequence of getting it wrong is the next person's analytics running under\n * the previous person's consent: the departure is followed by the same `privacy: null` a sign-out\n * publishes, BEFORE the arrival, so the next person is judged on their own preferences, which the\n * preferences effect below publishes after this one.\n /\n announceDeparture(SessionEndReason.REPLACED);\n setPrivacy(null);\n emitPreferencesChanged(null);\n } else if (previousUserId !== null) {\n announceDeparture(getSessionEndReason());\n }\n if (knownUserId !== null) {\n announcedUserIdRef.current = knownUserId;\n emit(FrontendEvents.USER_LOGIN, { userId: knownUserId, establishment: getSessionEstablishment() });\n }\n }, [knownUserId, emit, announceDeparture, emitPreferencesChanged, getSessionEndReason, getSessionEstablishment]);\n\n const primaryScopeInitiatorIds = useMemo<ExecutionContext_InitiatorIds \| null>(() => {\n return ScopeUtilsService.buildInitiatorIds({\n userId: appScope.currentUserId,\n organizationId: appScope.currentOrganizationId,\n applicationId: appScope.currentApplicationId,\n anonymousUserId: appScope.currentAnonymousUserId,\n });\n }, [\n appScope.currentApplicationId,\n appScope.currentAnonymousUserId,\n appScope.currentOrganizationId,\n appScope.currentUserId,\n ]);\n\n /\n Extract and store user preferences from context\n * Stores preferences in state for other contexts to read and apply\n /\n const storePreferences = useCallback((\n preferences: PreferencesPayload,\n organizationPreferences?: OrganizationContext['preferences'] \| null,\n ): void => {\n // Store privacy preferences in state\n if (preferences.privacy) {\n setPrivacy(preferences.privacy);\n }\n\n const currentOrganizationPreferences = organizationPreferences !== undefined\n ? organizationPreferences\n : currentOrganizationId\n ? organizations.find((organization) => organization._id === currentOrganizationId)?.preferences\n : undefined;\n\n // Emit preference change event to notify parent contexts\n emitPreferencesChanged(\n preferences,\n currentOrganizationPreferences,\n );\n }, [currentOrganizationId, emitPreferencesChanged, organizations]);\n\n /\n Compute effective permissions from user's app roles and organization roles\n * This is a basic implementation - can be enhanced based on role hierarchy\n /\n const computeEffectivePermissions = (\n userContext: UserContext,\n organizationsList: OrganizationContext[]\n ): EffectivePermissions \| null => {\n // App-level permissions from user's app roles\n const appLevel = (userContext.appRoles \|\| []) as string[];\n\n // Per-organization permissions from organization membership roles\n // Use new field name from relationship-based context\n const organizationsPermissions: Record<string, string[]> = {};\n const memberships = userContext.organizationMembers \|\| [];\n\n for (const membership of memberships) {\n organizationsPermissions[membership.organizationId] = (membership.roles \|\| []) as string[];\n }\n\n return {\n appLevel,\n organizations: organizationsPermissions,\n };\n };\n\n /\n Load organizations independently (can be called separately from authentication)\n /\n const loadOrganizations = useCallback(async (userContext: UserContext): Promise<{\n organizationsList: OrganizationContext[];\n selectedOrgId: string \| null;\n }> => {\n const allMemberships = userContext.organizationMembers \|\| [];\n\n // W7.3b: For one-off sessions, restrict to the scoped organization only\n const scopedOrgId = auth.sessionType === SessionType.ONE_OFF\n ? tokenStorage.getOrganizationId()\n : null;\n\n const memberships = scopedOrgId\n ? allMemberships.filter((m: any) => m.organizationId === scopedOrgId)\n : allMemberships;\n\n logDebug('Loading organizations', {\n userId: userContext._id,\n membershipCount: memberships.length,\n isOneOff: auth.sessionType === SessionType.ONE_OFF,\n });\n\n const organizationsList: OrganizationContext[] = [];\n\n if (memberships.length > 0) {\n const organizationsConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];\n if (!organizationsConfig) {\n logger.warn('ORGANIZATIONS resource not available');\n return { organizationsList, selectedOrgId: null };\n }\n\n // Shared with the route organization-access probe, which must address the same READ.\n const orgsReadOp = findDefaultApiReadOperation(organizationsConfig);\n\n if (!orgsReadOp) {\n logger.warn('ORGANIZATIONS READ operation not found');\n return { organizationsList, selectedOrgId: null };\n }\n\n const organizationsOperationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(orgsReadOp);\n\n /\n The tenant's preference record is fetched SEPARATELY, and that is a decision rather than an\n * omission (#563).\n \n `OrganizationContextSchema` declares `preferences`, and `doOperation<OrganizationContext>`\n * is a CAST — nothing validates the response against it — so the field read as available\n * while no producer existed: the ORGANIZATIONS default READ returns a plain\n * `Organization`, and the organisation's regional block therefore never reached\n * `I18nContext`. Every date and number in every generated application formatted at the\n * framework floor as a result.\n \n The rejected alternative was to switch this call to the ORGANIZATIONS context variant,\n * which does populate the child. Measured against the running stack on 2026-09-10, that\n * response carries every context-enabled child of an organisation — `auditLogs`, `todos`,\n * `tasks`, `knowledgeDocuments`, `organizationMembers`, … — so session restore would pull an\n * unbounded page of tenant data per membership to obtain four regional fields. (#583 has since\n * taken the audit and delivery logs off the context surface and capped every 1:many child at\n * `contextPolicy.limit`, 20 by default. The page is bounded now, but it is still a page of tenant\n * data per membership, so the reasoning stands.) The\n * preference record has its own default READ (`GET /organizations/{id}/organization-preference`,\n * reachable by an ordinary `ORG_MEMBER`), which is one small request with a stable shape.\n \n Best-effort by construction: a tenant whose preferences cannot be read still yields a\n * usable organisation, and `organizationPreferencesPayload(undefined)` then contributes\n * nothing to the i18n event rather than clearing the member's own settings.\n /\n const organizationPreferencesConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES];\n const organizationPreferencesReadOp = findDefaultApiReadOperation(organizationPreferencesConfig);\n\n if (!organizationPreferencesReadOp) {\n logger.warn('ORGANIZATION_PREFERENCES READ operation not found — tenant regional defaults will not be applied');\n }\n\n const organizationPreferencesOperationPath = organizationPreferencesReadOp\n ? ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(organizationPreferencesReadOp)\n : null;\n\n const fetchOrganizationPreferences = async (\n organizationId: string,\n ): Promise<OrganizationContext['preferences'] \| undefined> => {\n if (!organizationPreferencesOperationPath) return undefined;\n try {\n return await doOperation<NonNullable<OrganizationContext['preferences']>>(\n organizationPreferencesOperationPath,\n { contextualParameters: { organizationId } },\n ) ?? undefined;\n } catch (error) {\n logger.warn('Failed to fetch organization preferences', { organizationId, error });\n return undefined;\n }\n };\n\n const orgPromises = memberships.map(async (membership: any) => {\n try {\n const [org, preferences] = await Promise.all([\n doOperation<OrganizationContext>(\n organizationsOperationPath,\n { contextualParameters: { organizationId: membership.organizationId } }),\n fetchOrganizationPreferences(membership.organizationId),\n ]);\n\n if (!org) return null;\n // OMIT the key when the read failed rather than attaching `null`. The payload builder\n // reads the two differently: `undefined`/absent contributes nothing to the i18n event,\n // while `null` means \"the tenant has cleared its preferences\" and actively resets the\n // organisation half — which would silently downgrade a member to the framework floor\n // because one request failed.\n return preferences ? { ...org, preferences } : org;\n } catch (error) {\n logger.warn('Failed to fetch organization', { organizationId: membership.organizationId, error });\n return null;\n }\n });\n\n const orgResults = await Promise.all(orgPromises);\n organizationsList.push(...orgResults.filter((org): org is OrganizationContext => org !== null));\n }\n\n // Restore current organization selection\n const storedOrgId = tokenStorage.getOrganizationId();\n const selectedOrgId = storedOrgId && organizationsList.find(o => o._id === storedOrgId)\n ? storedOrgId\n : organizationsList[0]?._id \|\| null;\n\n // Compute effective permissions from roles\n const computedPermissions = computeEffectivePermissions(userContext, organizationsList);\n\n setOrganizations(organizationsList);\n commitOrganizationScopeValue(selectedOrgId);\n setPermissions(computedPermissions);\n\n logDebug('Organizations loaded', { organizationCount: organizationsList.length, currentOrganizationId: selectedOrgId });\n return { organizationsList, selectedOrgId };\n }, [commitOrganizationScopeValue, doOperation, registry, tokenStorage, auth.sessionType]);\n\n /\n Restore regular user session\n /\n const restoreUserSession = useCallback(async (accessToken: string): Promise<boolean> => {\n logDebug('Restoring user session');\n\n // Check if USER_SELF is available\n const availableResources = Object.keys(registry.resourceConfigurations);\n const hasUserSelf = availableResources.includes(CoreResourceType.USER_SELF);\n\n if (!hasUserSelf) {\n logger.warn('USER_SELF resource not available for session restoration');\n return false;\n }\n\n // Get USER_SELF resource config\n const userSelfConfig = registry.resourceConfigurations[CoreResourceType.USER_SELF];\n\n const readOperation = findDefaultApiReadOperation(userSelfConfig);\n\n if (!readOperation) {\n logger.warn('USER_SELF READ operation not found');\n return false;\n }\n\n // Find context variant (auto-generated with relationship population)\n const readContextOp = userSelfConfig.operations.find((op: any) =>\n op.operationIdentifier === CoreResourceOperation.READ &&\n op.isBulkOperation !== true &&\n (\n op.variantType === ResourceOperationVariantType.API_CALL \|\|\n op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n ) &&\n op.variantKey === OPERATION_VARIANT_KEY.CONTEXT\n );\n\n if (!readContextOp) {\n logger.warn('USER_SELF context variant not found');\n return false;\n }\n\n const initiatorInfo = readOperation.initiatorInfos?.[0];\n const requiresUserId = initiatorInfo?.parameters?.some((p: any) => p.fieldIdentifier === 'userId');\n\n const contextualParameters: Record<string, string> = {};\n\n if (requiresUserId && accessToken) {\n try {\n const payload = decodeJwtPayload<{ userId?: string }>(accessToken);\n if (payload.userId) {\n contextualParameters.userId = payload.userId;\n }\n } catch (e) {\n logDebug('Failed to decode JWT for userId extraction', { error: e });\n }\n }\n\n // Build operation path and fetch user context\n const contextPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readContextOp);\n const userContext = await doOperation<UserContext>(contextPath, { contextualParameters });\n\n if (!userContext) {\n logger.warn('Failed to fetch user context during session restoration');\n return false;\n }\n\n // Use new field name from relationship-based context\n const membershipsCount = (userContext.organizationMembers \|\| []).length;\n logDebug('User context restored', { userId: userContext._id, organizationCount: membershipsCount });\n\n // Update user state\n setUser(userContext);\n\n // Load organizations separately\n // If this fails, session restoration still succeeds (user context is restored)\n const { organizationsList, selectedOrgId } = await loadOrganizations(userContext);\n\n // Store preferences after organization loading so i18n receives user and\n // active-organization language policy in the same event.\n const preferences = userContext.userSelfPreferences;\n if (preferences) {\n const currentOrganization = selectedOrgId\n ? organizationsList.find((organization) => organization._id === selectedOrgId)\n : null;\n storePreferences(preferences, currentOrganization?.preferences);\n }\n\n logger.info('Session restored successfully', {\n userId: userContext._id,\n organizationCount: membershipsCount\n });\n\n return true;\n }, [doOperation, registry, loadOrganizations, storePreferences]);\n\n // Stop any pending restore-retry backoff when the provider unmounts, so the\n // loop in `restoreSession` bails instead of calling setState on a dead tree.\n useEffect(() => {\n restoreAbortRef.current = false;\n return () => {\n restoreAbortRef.current = true;\n if (restoreRetryTimerRef.current) {\n clearTimeout(restoreRetryTimerRef.current);\n restoreRetryTimerRef.current = null;\n }\n };\n }, []);\n\n /\n Restore session from stored JWT token\n * Fetches user context using USER_SELF resource (userId comes from JWT)\n * Then fetches full organization details for each organization membership\n \n Resilience: a TRANSIENT backend failure (unreachable / 5xx / timeout, or a\n * 401 whose in-flight renewal failed transiently) does NOT log out — restore\n * preserves the session and retries with capped exponential backoff until the\n * backend returns. Genuine authentication (401), authorization (403), and\n * non-network errors terminate immediately (no retry on a dead-or-buggy path).\n /\n const restoreSession = useCallback(async (): Promise<boolean> => {\n logDebug('Restoring session from stored token');\n\n // Check if session is already restored to avoid duplicate restoration attempts\n if (auth.sessionRestored && auth.accessToken && user) {\n logDebug('Session already restored, skipping restoration');\n return true;\n }\n\n // Read token from auth state\n const accessToken = auth.accessToken;\n\n if (!accessToken) {\n logDebug('No access token available');\n return false;\n }\n\n setSessionRestoring(true);\n\n let attempt = 0;\n // Single backoff loop: the invoking effect won't re-enter while\n // `isRestoringSession` is true, so this is the sole restore in flight.\n while (true) {\n try {\n const restored = await restoreUserSession(accessToken);\n\n if (restored) {\n markSessionRestored();\n\n // W7.3b: One-off sessions already connected WebSocket in handleOneOffTokenExchange\n // (with consumableToken). Reconnecting here would lose the consumable token.\n if (auth.sessionType !== SessionType.ONE_OFF) {\n // Connect with the FRESHEST token, read live from storage — NOT the\n // `accessToken` captured at the top of `restoreSession`. During the\n // awaited `restoreUserSession` above, the HTTP interceptor may have\n // hit a `401 OUTDATED_AUTH_JWT` and rotated the token via\n // `tokenRenewalHandler` (which writes the new token to storage AND\n // seeds the WS `authStateRef` synchronously). The captured\n // `accessToken` is then stale/expired; passing it into `connect()`\n // reseeds the WS credential source-of-truth back to the expired token\n // (clobbering the fresh one the refresh just stored), and the Socket.IO\n // handshake gets rejected with \"Authentication failed\". `getAccessToken()`\n // returns the live, post-refresh value (falling back to the captured\n // token only if storage is somehow empty).\n const freshestAccessToken = tokenStorage.getAccessToken() ?? accessToken;\n connectWebSocket(freshestAccessToken, tokenStorage.getOrganizationId());\n }\n } else {\n logger.warn('Session restoration could not build a valid authenticated context; logging out to avoid a half-restored state');\n endSession(SessionEndReason.SESSION_ENDED);\n }\n\n return restored;\n\n } catch (error: any) {\n // Authorization (403 / scope) is checked FIRST and is non-destructive: a\n // permission denial must NEVER destroy a valid session. Authentication\n // (401 / session-invalid) is the only branch that force-logs-out.\n // `isAuthenticationError` already excludes authorization errors (see\n // `AuthSessionUtils`), so these are mutually exclusive — the explicit\n // ordering here is defense-in-depth so the non-destructive path wins even\n // if that guard is ever loosened.\n const isAuthorizationError = AuthSessionUtils.isAuthorizationError(error);\n\n if (isAuthorizationError) {\n const errorMessage = error?.message \|\| 'Session restoration blocked by authorization';\n logger.warn('Session restoration encountered authorization/scope error', {\n error: errorMessage,\n errorType: error?.wildoError?.type \|\| error?.response?.data?.error?.type,\n status: error?.response?.status,\n });\n setSessionRestoring(false);\n markSessionRestored();\n return false;\n }\n\n // TRANSIENT backend failure (checked BEFORE the authentication branch so\n // a 401 whose renewal failed transiently is retried, not logged out):\n // preserve the session, back off, and retry. Bail if the component\n // unmounted or the session was cleared (logout elsewhere) while waiting.\n if (isTransientBackendFailure(error)) {\n attempt += 1;\n const delay = Math.min(\n RESTORE_RETRY_BASE_DELAY_MS 2 (attempt - 1),\n RESTORE_RETRY_MAX_DELAY_MS,\n );\n logger.warn('Session restoration hit a transient backend failure; preserving session and retrying', {\n attempt,\n retryInMs: delay,\n status: error?.response?.status,\n code: error?.code,\n });\n await new Promise<void>((resolve) => {\n restoreRetryTimerRef.current = setTimeout(resolve, delay);\n });\n if (restoreAbortRef.current \|\| !tokenStorage.getAccessToken()) {\n setSessionRestoring(false);\n return false;\n }\n continue;\n }\n\n if (AuthSessionUtils.isAuthenticationError(error)) {\n logDebug('Session restoration failed due to authentication error', {\n errorType: error?.wildoError?.type \|\| error?.response?.data?.error?.type,\n status: error?.response?.status,\n });\n endSession(SessionEndReason.SESSION_ENDED);\n return false;\n }\n\n // Fail closed on unexpected NON-transient errors. A partially restored\n // authenticated shell is less safe than dropping back to a clean login.\n const errorMessage = error?.message \|\| 'Session restoration failed';\n logger.warn('Session restoration encountered a non-transient error; logging out', {\n error: errorMessage,\n errorType: error?.wildoError?.type,\n });\n\n endSession(SessionEndReason.SESSION_ENDED);\n return false;\n }\n }\n }, [\n restoreUserSession,\n auth.sessionRestored,\n auth.sessionType,\n auth.accessToken,\n user,\n endSession,\n markSessionRestored,\n setSessionRestoring,\n connectWebSocket,\n tokenStorage\n ]);\n\n /\n * Refresh organizations data (e.g., after organization update)\n /\n const refreshOrganizations = useCallback(async (): Promise<void> => {\n // Use new field name from relationship-based context\n const memberships = user?.organizationMembers \|\| [];\n\n if (memberships.length === 0) {\n logDebug('No organizations membership to refresh');\n return;\n }\n\n logDebug('Refreshing organizations', { membershipCount: memberships.length });\n\n // Use loadOrganizations to refresh\n await loadOrganizations(user!);\n }, [user, loadOrganizations]);\n\n useEffect(() => {\n if (!user?.userSelfPreferences) {\n return;\n }\n\n const currentOrganization = currentOrganizationId\n ? organizations.find((organization) => organization._id === currentOrganizationId)\n : null;\n\n emitPreferencesChanged(\n user.userSelfPreferences,\n currentOrganization?.preferences,\n );\n }, [currentOrganizationId, emitPreferencesChanged, organizations, user]);\n\n /\n Set the current active organization\n /\n const setCurrentOrganization = useCallback((organizationId: string): void => {\n // Validate that organization exists in user's organizations\n const org = organizations.find(o => o._id === organizationId);\n if (!org) {\n logger.warn('Attempted to set invalid organization', { organizationId, availableOrganizations: organizations.map(o => o._id) });\n return;\n }\n\n const previousOrganizationId = currentOrganizationId;\n\n // Skip if the organization hasn't changed\n if (previousOrganizationId === organizationId) {\n return;\n }\n\n logDebug('Setting current organization', { organizationId, organizationName: org.name, previousOrganizationId });\n commitOrganizationScopeValue(organizationId);\n }, [organizations, currentOrganizationId, commitOrganizationScopeValue]);\n\n /\n Get the current active organization\n /\n const getCurrentOrganization = useCallback((): OrganizationContext \| null => {\n if (!currentOrganizationId) {\n return null;\n }\n return organizations.find(o => o._id === currentOrganizationId) \|\| null;\n }, [currentOrganizationId, organizations]);\n\n /\n Get privacy preferences\n /\n const getPrivacy = useCallback((): UserPrivacy \| null => {\n return privacy;\n }, [privacy]);\n\n // Depend on the builder alone: the whole AppScope value changes with every custom scope value, and through\n // this callback it would re-render every `useUserOrgs` consumer.\n const buildScopeContextualParameters = appScope.buildContextualParameters;\n const recordConsentDecision = useCallback(async (grantedPurposes: readonly ConsentPurpose[]): Promise<UserPrivacy> => {\n const operation = registry.resourceConfigurations[CoreResourceType.USER_SELF_PREFERENCES]?.operations.find(\n (candidate) => candidate.operationIdentifier === CoreResourceOperation.UPDATE\n && candidate.isOperationDefault === true\n && candidate.isBulkOperation !== true\n && (\n candidate.variantType === ResourceOperationVariantType.API_CALL\n \|\| candidate.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n ),\n );\n if (!operation) {\n throw new Error('Cannot record a consent decision: this application mounts no user self-preferences UPDATE operation');\n }\n\n const updated = await doOperation<UserPreferences>(\n ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(operation),\n {\n // This provider sits ABOVE `ScopedResourceRegistryProvider`, so the `doOperation` it holds injects\n // no scope: the user id the self-preferences route is addressed by has to be supplied here. With an\n // empty set the client could not build the URL and every decision failed before a request left\n // (`frontend_resource_no_endpoint_available`, #977 — found by driving the prompt in a browser).\n contextualParameters: buildScopeContextualParameters(),\n requestData: {\n // The client instant is only a CLAIM that this write is a decision; the server replaces it.\n privacy: { consentedPurposes: normalizeConsentPurposes(grantedPurposes), consentDecidedAt: new Date() },\n },\n },\n );\n const storedPrivacy = updated?.privacy;\n if (!storedPrivacy) {\n throw new Error('Consent decision was written but the response carried no privacy block');\n }\n\n setPrivacy(storedPrivacy);\n // Updating the user's preferences record re-emits USER_PREFERENCES_CHANGED through the effect\n // above, which is how the analytics provider learns the new set without a second channel.\n setUser((previous) => previous\n ? { ...previous, userSelfPreferences: { ...(previous.userSelfPreferences ?? {}), privacy: storedPrivacy } as UserContext['userSelfPreferences'] }\n : previous);\n // While a required purpose was missing the backend refused this person's organization reads, so\n // session restore may have loaded none (#534 re-review N1). Re-load them now that the decision is\n // stored; a failure leaves the decision recorded and is retried on the next restore.\n if (organizations.length === 0) {\n await refreshOrganizations().catch((error: unknown) => {\n logger.warn('Organizations could not be re-loaded after a consent decision', { error });\n });\n }\n return storedPrivacy;\n }, [buildScopeContextualParameters, doOperation, registry, organizations.length, refreshOrganizations]);\n\n /\n Logout wrapper that also clears user/org data\n */\n const logout = useCallback((): void => {\n logDebug('Logging out user', { userId: user?._id, organizationId: currentOrganizationId });\n\n // Announced first, while the person's consent still holds — see the block above (#1977).\n announceDeparture(SessionEndReason.SIGNED_OUT);\n\n // Clear user/org data first\n setUser(null);\n setOrganizations([]);\n commitOrganizationScopeValue(null);\n setPermissions(null);\n setPrivacy(null);\n emitPreferencesChanged(null);\n\n // Reset initialization flag\n hasInitializedRef.current = false;\n previousTokenRef.current = null;\n\n // Call auth logout (clears tokens, disconnects WebSocket)\n authLogout();\n }, [user?._id, currentOrganizationId, authLogout, announceDeparture, commitOrganizationScopeValue, emitPreferencesChanged]);\n\n // Auto-load user/org data when token becomes available\n useEffect(() => {\n const accessToken = auth.accessToken;\n\n // Skip if no token or token hasn't changed\n if (!accessToken \|\| accessToken === previousTokenRef.current) {\n return;\n }\n\n // Skip if session is already restored with this token\n if (auth.sessionRestored && user) {\n previousTokenRef.current = accessToken;\n return;\n }\n\n // Skip if already initializing\n if (hasInitializedRef.current && auth.isRestoringSession) {\n return;\n }\n\n logDebug('Token changed, initiating session restoration', {\n hasToken: !!accessToken,\n previousToken: !!previousTokenRef.current\n });\n\n previousTokenRef.current = accessToken;\n hasInitializedRef.current = true;\n\n // Restore session (will fetch user/org data)\n restoreSession().catch((error) => {\n logger.error('Session restoration failed', { error });\n });\n }, [auth.accessToken, auth.sessionRestored, auth.isRestoringSession, user, restoreSession]);\n\n // Clear data when token is removed (logged out)\n useEffect(() => {\n if (!auth.accessToken && previousTokenRef.current) {\n logDebug('Token removed, clearing user/org data');\n // Announced before `privacy: null`, with the reason the auth session recorded (#1977).\n announceDeparture(getSessionEndReason());\n setUser(null);\n setOrganizations([]);\n commitOrganizationScopeValue(null);\n setPermissions(null);\n setPrivacy(null);\n emitPreferencesChanged(null);\n previousTokenRef.current = null;\n hasInitializedRef.current = false;\n }\n }, [auth.accessToken, announceDeparture, commitOrganizationScopeValue, emitPreferencesChanged, getSessionEndReason]);\n\n const value = useMemo<UserOrgsContextType>(() => ({\n // Re-exported from AuthSession for backward compatibility\n auth,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout,\n restoreSession,\n\n // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n initiateOAuth2Login,\n handleAuthCodeExchange,\n\n // User data\n user,\n\n // Organization data\n organizations,\n currentOrganizationId,\n permissions,\n primaryScopeInitiatorIds,\n\n // Privacy (only preference managed here)\n privacy,\n\n // Organization management\n setCurrentOrganization,\n getCurrentOrganization,\n refreshOrganizations,\n\n // Privacy getter\n getPrivacy,\n recordConsentDecision,\n }), [\n auth,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout,\n restoreSession,\n initiateOAuth2Login,\n handleAuthCodeExchange,\n user,\n organizations,\n currentOrganizationId,\n permissions,\n primaryScopeInitiatorIds,\n privacy,\n setCurrentOrganization,\n getCurrentOrganization,\n refreshOrganizations,\n getPrivacy,\n recordConsentDecision,\n ]);\n\n return <UserOrgsContext.Provider value={value}>{children}</UserOrgsContext.Provider>;\n};\n\n// useUserOrgs hook is now in separate file: ./useUserOrgs.ts\n// This separation is required for React Fast Refresh compatibility\n"]}
1	+ {"version":3,"file":"UserOrgsContext.js","sourceRoot":"","sources":["../../../../../src/core/security/UserOrgsContext.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,aAAa,EAAE,QAAQ,EAAa,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACvH,OAAO,EAGL,gBAAgB,EAChB,kCAAkC,EAClC,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EAIrB,WAAW,EACX,wBAAwB,EACxB,mBAAmB,GAGpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,6CAA6C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAI3G,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,gCAAgC,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC5H,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,oEAAoE,CAAC;AAC3I,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAChG,OAAO,EAAE,2BAA2B,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAC5H,OAAO,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,6EAA6E,CAAC;AAC3H,OAAO,EAAE,sCAAsC,EAAE,MAAM,2CAA2C,CAAC;AAEnG,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AACxE,MAAM,QAAQ,GAAiE,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;AACrH,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAwE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmD,aAAa,CAAkC,SAAS,CAAC,CAAC;AAEzI,MAAM,CAAC,MAAM,gBAAgB,GAAsC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IAClF,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAE/B,+BAA+B;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,MAAM,EAAE,UAAU,EAClB,UAAU,EACV,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,GAAG,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,4BAA4B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC/D,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IAC7D,0GAA0G;IAC1G,MAAM,wBAAwB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC/D,wBAAwB,CAAC,OAAO,GAAG,qBAAqB,CAAC;IAEzD,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,gBAAgB,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IACrD,yEAAyE;IACzE,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,oBAAoB,GAAG,MAAM,CAAuC,IAAI,CAAC,CAAC;IAEhF,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAC3D,6GAA6G;IAC7G,MAAM,eAAe,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IACpD,eAAe,CAAC,OAAO,GAAG,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC;IAE5C,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAwB,EAAE,CAAC,CAAC;IAE9E,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAA8B,IAAI,CAAC,CAAC;IAElF,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAIjE;;;;;;;;;OASG;IACH,MAAM,8BAA8B,GAAG,CACrC,uBAA8E,EACrD,EAAE;QAC3B,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,uBAAuB,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,+BAA+B,EAAE,uBAAuB,CAAC,mBAAmB,IAAI,IAAI;YACpF,+BAA+B,EAAE;gBAC/B,QAAQ,EAAE,uBAAuB,CAAC,QAAQ;gBAC1C,MAAM,EAAE,uBAAuB,CAAC,MAAM;gBACtC,UAAU,EAAE,uBAAuB,CAAC,UAAU;gBAC9C,UAAU,EAAE,uBAAuB,CAAC,UAAU;aAC/C;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,sBAAsB,GAAG,WAAW,CAAC,CACzC,WAAkD,EAClD,uBAAmE,EAC7D,EAAE;QACR,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;gBAC5C,mBAAmB,EAAE,IAAI;gBACzB,+BAA+B,EAAE,IAAI;gBACrC,mBAAmB,EAAE,IAAI;gBACzB,+BAA+B,EAAE,IAAI;gBACrC,wBAAwB,EAAE,IAAI;gBAC9B,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;YAC5C,GAAG,CAAC,WAAW,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnH,GAAG,8BAA8B,CAAC,uBAAuB,CAAC;YAC1D,GAAG,CAAC,WAAW,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,WAAW,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,kBAAkB,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IACvD,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,MAAwB,EAAQ,EAAE;QACvE,MAAM,cAAc,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAClD,IAAI,cAAc,KAAK,IAAI;YAAE,OAAO;QACpC,kBAAkB,CAAC,OAAO,GAAG,IAAI,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACX,MAAM,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC;IACtC,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,cAAc,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAClD,IAAI,cAAc,KAAK,WAAW;YAAE,OAAO;QAC3C,IAAI,cAAc,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACpD;;;;;;;;eAQG;YACH,iBAAiB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YACnC,iBAAiB,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,kBAAkB,CAAC,OAAO,GAAG,WAAW,CAAC;YACzC,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAEjH,MAAM,wBAAwB,GAAG,OAAO,CAAuC,GAAG,EAAE;QAClF,OAAO,iBAAiB,CAAC,iBAAiB,CAAC;YACzC,MAAM,EAAE,QAAQ,CAAC,aAAa;YAC9B,cAAc,EAAE,QAAQ,CAAC,qBAAqB;YAC9C,aAAa,EAAE,QAAQ,CAAC,oBAAoB;YAC5C,eAAe,EAAE,QAAQ,CAAC,sBAAsB;SACjD,CAAC,CAAC;IACL,CAAC,EAAE;QACD,QAAQ,CAAC,oBAAoB;QAC7B,QAAQ,CAAC,sBAAsB;QAC/B,QAAQ,CAAC,qBAAqB;QAC9B,QAAQ,CAAC,aAAa;KACvB,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,CACnC,WAA+B,EAC/B,uBAAmE,EAC7D,EAAE;QACR,qCAAqC;QACrC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,8BAA8B,GAAG,uBAAuB,KAAK,SAAS;YAC1E,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,qBAAqB;gBACrB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,WAAW;gBAC/F,CAAC,CAAC,SAAS,CAAC;QAEhB,yDAAyD;QACzD,sBAAsB,CACpB,WAAW,EACX,8BAA8B,CAC/B,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,CAAC,CAAC,CAAC;IAEnE;;;;;;;OAOG;IACH,MAAM,iBAAiB,GAAG,KAAK,IAA2C,EAAE;QAC1E,MAAM,cAAc,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,sBAAsB,GAAG,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CACzE,EAAE,CAAC,mBAAmB,KAAK,mBAAmB,CAAC,cAAc;YAC7D,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;YACxD,EAAE,CAAC,eAAe,KAAK,IAAI,CAC5B,CAAC;QACF,IAAI,CAAC,sBAAsB;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,sBAAsB,CAAC,CAAC;YACpH,OAAO,CAAC,MAAM,WAAW,CAAwB,aAAa,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QACzG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,yGAAyG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClI,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,2BAA2B,GAAG,CAClC,WAAwB,EACxB,iBAAwC,EACX,EAAE;QAC/B,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAa,CAAC;QAE1D,kEAAkE;QAClE,qDAAqD;QACrD,MAAM,wBAAwB,GAA6B,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE1D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,wBAAwB,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAa,CAAC;QAC7F,CAAC;QAED,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,wBAAwB;YACvC,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC,CAAC;IAEF;;;;;;;OAOG;IACH,MAAM,oBAAoB,GAAG,WAAW,CAAC,KAAK,EAAE,cAAsB,EAAuC,EAAE;QAC7G,MAAM,mBAAmB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC5F,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,qFAAqF;QACrF,MAAM,UAAU,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,0BAA0B,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,UAAU,CAAC,CAAC;QAErH;;;;;;;;;;;;;;;;;;;;;;;;;WAyBG;QACH,MAAM,6BAA6B,GAAG,2BAA2B,CAAC,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC9I,MAAM,4BAA4B,GAAG,KAAK,IAA6D,EAAE;YACvG,8FAA8F;YAC9F,IAAI,CAAC,6BAA6B;gBAAE,OAAO,SAAS,CAAC;YACrD,IAAI,CAAC;gBACH,OAAO,MAAM,WAAW,CACtB,kCAAkC,CAAC,kCAAkC,CAAC,6BAA6B,CAAC,EACpG,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,EAAE,CAC7C,IAAI,SAAS,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC3C,WAAW,CAAsB,0BAA0B,EAAE,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC;gBAC1G,4BAA4B,EAAE;aAC/B,CAAC,CAAC;YACH,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,qFAAqF;YACrF,8BAA8B;YAC9B,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE5B;;;;;OAKG;IACH,MAAM,wBAAwB,GAAG,WAAW,CAAC,CAAC,cAAsB,EAAQ,EAAE;QAC5E,MAAM,gBAAgB,GAAG,eAAe,CAAC,OAAO,CAAC;QACjD,KAAK,oBAAoB,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE;YAC9D,IAAI,CAAC,YAAY,IAAI,eAAe,CAAC,OAAO,KAAK,gBAAgB;gBAAE,OAAO;YAC1E,gBAAgB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1I,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAE3B;;OAEG;IACH,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAwB,EAGlE,EAAE;QACH,gHAAgH;QAChH,kHAAkH;QAClH,MAAM,oBAAoB,GAAG,iBAAiB,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE7D,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;YAC1D,CAAC,CAAC,YAAY,CAAC,iBAAiB,EAAE;YAClC,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,WAAW,GAAG,WAAW;YAC7B,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC;YACrE,CAAC,CAAC,cAAc,CAAC;QAEnB,QAAQ,CAAC,uBAAuB,EAAE;YAChC,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,eAAe,EAAE,WAAW,CAAC,MAAM;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC;YAC7G,MAAM,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,iBAAiB,GAA0B,EAAE,CAAC;QACpD,MAAM,6BAA6B,GAAG,MAAM,OAAO,CAAC,GAAG,CACrD,WAAW,CAAC,GAAG,CAAC,CAAC,UAAe,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAC9F,CAAC;QACF,iBAAiB,CAAC,IAAI,CAAC,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC,GAAG,EAA8B,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC;QAEnH,0GAA0G;QAC1G,0GAA0G;QAC1G,yGAAyG;QACzG,6GAA6G;QAC7G,6GAA6G;QAC7G,sBAAsB;QACtB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC;QAClD,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,CAAC,cAA6B,EAA4B,EAAE,CAC3E,CAAC,CAAC,cAAc,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;QAC5E,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC;QAEjD,8GAA8G;QAC9G,+GAA+G;QAC/G,gHAAgH;QAChH,+GAA+G;QAC/G,6GAA6G;QAC7G,8GAA8G;QAC9G,MAAM,cAAc,GAAG,QAAQ,IAAI,WAAW,CAAC;QAC/C,IACE,cAAc;eACX,CAAC,QAAQ,CAAC,cAAc,CAAC;eACzB,CAAC,CAAC,WAAW,IAAI,cAAc,KAAK,WAAW,CAAC;eAChD,gCAAgC,CAAC,aAAa,EAAE,cAAc,CAAC,EAClE,CAAC;YACD,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;YACzE,IAAI,qBAAqB;gBAAE,iBAAiB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACtC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACrB,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;QAExC,+GAA+G;QAC/G,2FAA2F;QAC3F,MAAM,qBAAqB,GAAG,2BAA2B,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC1F,MAAM,mBAAmB,GAAG,qBAAqB;YAC/C,CAAC,CAAC,EAAE,GAAG,qBAAqB,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,gCAAgC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE;YACxH,CAAC,CAAC,IAAI,CAAC;QAET,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACpC,4BAA4B,CAAC,aAAa,CAAC,CAAC;QAC5C,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAEpC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC,CAAC;QACxH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC,EAAE,CAAC,4BAA4B,EAAE,oBAAoB,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAEnG;;OAEG;IACH,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAmB,EAAoB,EAAE;QACrF,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAEnC,kCAAkC;QAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAE5E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEnF,MAAM,aAAa,GAAG,2BAA2B,CAAC,cAAc,CAAC,CAAC;QAElE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,MAAM,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CAC/D,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;YACrD,EAAE,CAAC,eAAe,KAAK,IAAI;YAC3B,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;YACxD,EAAE,CAAC,UAAU,KAAK,qBAAqB,CAAC,OAAO,CAChD,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC;QAEnG,MAAM,oBAAoB,GAA2B,EAAE,CAAC;QAExD,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,gBAAgB,CAAsB,WAAW,CAAC,CAAC;gBACnE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,oBAAoB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC/C,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,MAAM,WAAW,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,aAAa,CAAC,CAAC;QACzG,MAAM,WAAW,GAAG,MAAM,WAAW,CAAc,WAAW,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,CAAC,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACxE,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEpG,oBAAoB;QACpB,OAAO,CAAC,WAAW,CAAC,CAAC;QAErB,gCAAgC;QAChC,+EAA+E;QAC/E,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAElF,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,mBAAmB,GAAG,aAAa;gBACvC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,aAAa,CAAC;gBAC9E,CAAC,CAAC,IAAI,CAAC;YACT,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC3C,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,iBAAiB,EAAE,gBAAgB;SACpC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,6EAA6E;IAC7E,SAAS,CAAC,GAAG,EAAE;QACb,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,OAAO,GAAG,EAAE;YACV,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,IAAI,oBAAoB,CAAC,OAAO,EAAE,CAAC;gBACjC,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC3C,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACtC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;;;;;;;OAUG;IACH,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,IAAsB,EAAE;QACjE,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAEhD,+EAA+E;QAC/E,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YACrD,QAAQ,CAAC,gDAAgD,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,gEAAgE;QAChE,uEAAuE;QACvE,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBAEvD,IAAI,QAAQ,EAAE,CAAC;oBACb,mBAAmB,EAAE,CAAC;oBAEtB,mFAAmF;oBACnF,6EAA6E;oBAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;wBAC7C,oEAAoE;wBACpE,oEAAoE;wBACpE,oEAAoE;wBACpE,0DAA0D;wBAC1D,mEAAmE;wBACnE,2DAA2D;wBAC3D,mEAAmE;wBACnE,sEAAsE;wBACtE,wEAAwE;wBACxE,2EAA2E;wBAC3E,qEAAqE;wBACrE,2CAA2C;wBAC3C,MAAM,mBAAmB,GAAG,YAAY,CAAC,cAAc,EAAE,IAAI,WAAW,CAAC;wBACzE,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC;oBAC1E,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,+GAA+G,CAAC,CAAC;oBAC7H,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;gBAC7C,CAAC;gBAED,OAAO,QAAQ,CAAC;YAElB,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,yEAAyE;gBACzE,uEAAuE;gBACvE,kEAAkE;gBAClE,qEAAqE;gBACrE,sEAAsE;gBACtE,0EAA0E;gBAC1E,kCAAkC;gBAClC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAE1E,IAAI,oBAAoB,EAAE,CAAC;oBACzB,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,8CAA8C,CAAC;oBACtF,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;wBACvE,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAC3B,mBAAmB,EAAE,CAAC;oBACtB,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,yEAAyE;gBACzE,sEAAsE;gBACtE,mEAAmE;gBACnE,yEAAyE;gBACzE,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrC,OAAO,IAAI,CAAC,CAAC;oBACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,2BAA2B,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAChD,0BAA0B,CAC3B,CAAC;oBACF,MAAM,CAAC,IAAI,CAAC,sFAAsF,EAAE;wBAClG,OAAO;wBACP,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;wBAC/B,IAAI,EAAE,KAAK,EAAE,IAAI;qBAClB,CAAC,CAAC;oBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;wBAClC,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC5D,CAAC,CAAC,CAAC;oBACH,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC9D,mBAAmB,CAAC,KAAK,CAAC,CAAC;wBAC3B,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClD,QAAQ,CAAC,wDAAwD,EAAE;wBACjE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,wGAAwG;oBACxG,UAAU,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC9C,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,uEAAuE;gBACvE,wEAAwE;gBACxE,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,4BAA4B,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;oBAChF,KAAK,EAAE,YAAY;oBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI;iBACnC,CAAC,CAAC;gBAEH,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;gBAC3C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC,EAAE;QACD,kBAAkB;QAClB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI;QACJ,UAAU;QACV,mBAAmB;QACnB,mBAAmB;QACnB,gBAAgB;QAChB,YAAY;KACb,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,MAAM,CAAC,wBAAwB,EAAE,2BAA2B,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,IAAsB,EAAE;QAC9D,IAAI,CAAC;YACH,OAAO,MAAM,iBAAiB,EAAE,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,MAAM,YAAY,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YACnD,IAAI,YAAY;gBAAE,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC;IAEtC;;OAEG;IACH,MAAM,oBAAoB,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACjE,qDAAqD;QACrD,MAAM,WAAW,GAAG,IAAI,EAAE,mBAAmB,IAAI,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,wCAAwC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,0BAA0B,EAAE,EAAE,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9E,mCAAmC;QACnC,MAAM,iBAAiB,CAAC,IAAK,CAAC,CAAC;IACjC,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE9B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,GAAG,qBAAqB;YAC/C,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC;YAClF,CAAC,CAAC,IAAI,CAAC;QAET,sBAAsB,CACpB,IAAI,CAAC,mBAAmB,EACxB,mBAAmB,EAAE,WAAW,CACjC,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;IAEzE;;;;;;;;;;;OAWG;IACH,MAAM,6BAA6B,GAAG,UAAU,CAAC,sCAAsC,CAAC,CAAC;IACzF,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;QAC1D,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,OAAO,EAAE,IAAI,KAAK,IAAI;QACtB,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACzC,8BAA8B,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,wBAAwB,KAAK,IAAI,CAAC,WAAW;KAC3G,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE;QACb,6BAA6B,EAAE,CAAC,sBAAsB,CAAC,CAAC;IAC1D,CAAC,EAAE,CAAC,6BAA6B,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAE5D;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,CAAC,cAAsB,EAAQ,EAAE;QAC1E,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;QAC9D,gHAAgH;QAChH,kHAAkH;QAClH,iHAAiH;QACjH,sGAAsG;QACtG,MAAM,SAAS,GAAG,CAAC,GAAG;eACjB,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;eACxC,gCAAgC,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QACD,IAAI,SAAS;YAAE,wBAAwB,CAAC,cAAc,CAAC,CAAC;QAExD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;QAErD,0CAA0C;QAC1C,IAAI,sBAAsB,KAAK,cAAc,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7I,4BAA4B,CAAC,cAAc,EAAE,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACpF,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAElI;;;;;;;;;;;;;OAaG;IACH,MAAM,uBAAuB,GAAG,WAAW,CAAC,CAAC,cAAsB,EAAW,EAAE;QAC9E,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,gCAAgC,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;QAC/F,MAAM,cAAc,GAAG,iCAAiC,CAAC,IAAI,EAAE,mBAAmB,EAAE,cAAc,CAAC,IAAI,MAAM,IAAI,SAAS,CAAC;QAC3H,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,kEAAkE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;YACpG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,wBAAwB,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,qBAAqB,KAAK,cAAc,EAAE,CAAC;YAC7C,QAAQ,CAAC,kCAAkC,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAChH,4BAA4B,CAAC,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAExI;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,GAA+B,EAAE;QAC1E,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,qBAAqB,CAAC,IAAI,IAAI,CAAC;IAC1E,CAAC,EAAE,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC,CAAC;IAE3C;;OAEG;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,GAAuB,EAAE;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,2GAA2G;IAC3G,iEAAiE;IACjE,MAAM,8BAA8B,GAAG,QAAQ,CAAC,yBAAyB,CAAC;IAC1E,MAAM,qBAAqB,GAAG,WAAW,CAAC,KAAK,EAAE,eAA0C,EAAwB,EAAE;QACnH,MAAM,SAAS,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,UAAU,CAAC,IAAI,CACxG,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,MAAM;eACxE,SAAS,CAAC,kBAAkB,KAAK,IAAI;eACrC,SAAS,CAAC,eAAe,KAAK,IAAI;eAClC,CACD,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ,CAChE,CACJ,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;QACzH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,kCAAkC,CAAC,kCAAkC,CAAC,SAAS,CAAC,EAChF;YACE,mGAAmG;YACnG,oGAAoG;YACpG,+FAA+F;YAC/F,gGAAgG;YAChG,oBAAoB,EAAE,8BAA8B,EAAE;YACtD,WAAW,EAAE;gBACX,4FAA4F;gBAC5F,OAAO,EAAE,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,eAAe,CAAC,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,EAAE;aACxG;SACF,CACF,CAAC;QACF,MAAM,aAAa,GAAG,OAAO,EAAE,OAAO,CAAC;QACvC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QAED,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,8FAA8F;QAC9F,0FAA0F;QAC1F,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ;YAC5B,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAwC,EAAE;YACjJ,CAAC,CAAC,QAAQ,CAAC,CAAC;QACd,gGAAgG;QAChG,kGAAkG;QAClG,qFAAqF;QACrF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACpD,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1F,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC,EAAE,CAAC,8BAA8B,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAExG;;OAEG;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAS,EAAE;QACpC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAE3F,yFAAyF;QACzF,iBAAiB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAE/C,4BAA4B;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACnC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAE7B,4BAA4B;QAC5B,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QAClC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEhC,0DAA0D;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE,UAAU,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAE5H,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,2CAA2C;QAC3C,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;YACvC,OAAO;QACT,CAAC;QAED,+BAA+B;QAC/B,IAAI,iBAAiB,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,+CAA+C,EAAE;YACxD,QAAQ,EAAE,CAAC,CAAC,WAAW;YACvB,aAAa,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO;SAC1C,CAAC,CAAC;QAEH,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;QACvC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEjC,6CAA6C;QAC7C,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/B,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5F,gDAAgD;IAChD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAClD,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YAClD,uFAAuF;YACvF,iBAAiB,CAAC,mBAAmB,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;YACnC,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC7B,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QACpC,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAErH,MAAM,KAAK,GAAG,OAAO,CAAsB,GAAG,EAAE,CAAC,CAAC;QAChD,0DAA0D;QAC1D,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QAEd,uEAAuE;QACvE,mBAAmB;QACnB,sBAAsB;QAEtB,YAAY;QACZ,IAAI;QAEJ,oBAAoB;QACpB,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QAExB,yCAAyC;QACzC,OAAO;QAEP,0BAA0B;QAC1B,sBAAsB;QACtB,uBAAuB;QACvB,sBAAsB;QACtB,oBAAoB;QAEpB,iBAAiB;QACjB,UAAU;QACV,qBAAqB;KACtB,CAAC,EAAE;QACF,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QACd,mBAAmB;QACnB,sBAAsB;QACtB,IAAI;QACJ,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QACxB,OAAO;QACP,sBAAsB;QACtB,uBAAuB;QACvB,sBAAsB;QACtB,oBAAoB;QACpB,UAAU;QACV,qBAAqB;KACtB,CAAC,CAAC;IAEH,OAAO,KAAC,eAAe,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA4B,CAAC;AACvF,CAAC,CAAC","sourcesContent":["import React, { createContext, useState, ReactNode, useMemo, useEffect, useCallback, useRef, useContext } from 'react';\nimport {\n UserContext,\n OrganizationContext,\n CoreResourceType,\n ResourcesConfig_OperationPathUtils,\n CoreResourceOperation,\n ResourceOperationVariantType,\n OPERATION_VARIANT_KEY,\n ExecutionContext_InitiatorIds,\n UserPrivacy,\n UserPreferences,\n SessionType,\n normalizeConsentPurposes,\n UserSelf_Operations,\n type ConsentPurpose,\n type UserSelfAccessProfile,\n} from '@wildo-ai/saas-models';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useEventBus } from '~wildo-frontend-lib/core/events/useEventBus';\nimport { FrontendEvents, SessionEndReason } from '~wildo-frontend-lib/core/events/events.frontend.schemas';\nimport {\n EffectivePermissions,\n} from './security.frontend.schemas';\nimport { useAuthSession } from './useAuthSession';\nimport { AuthSessionUtils } from './auth-session.utils';\nimport { accessProfileConfersOrganization, membershipRolesFromAccessProfile } from './effective-permissions.frontend.utils';\nimport { isTransientBackendFailure, sessionEndReasonForRefusal } from '~wildo-frontend-lib/core/requests/auth-refresh-resilience.frontend';\nimport { decodeJwtPayload } from './jwt.frontend.utils';\nimport { useAppScope } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { useAppScopeInternal } from '~wildo-frontend-lib/core/scope/AppScopeContext';\nimport { ScopeUtilsService } from '~wildo-frontend-lib/core/scope/scope.utils.frontend.service';\nimport { findDefaultApiReadOperation, hasActiveMembershipInOrganization } from './route-organization-access.frontend.utils';\nimport { ScopeChangeInitiator } from '~wildo-frontend-lib/core/scope/scope.frontend.schemas';\nimport { deriveRegionalReaderStanding } from '~wildo-frontend-lib/core/i18n/regional-preference-resolution.frontend.utils';\nimport { RegionalReaderStandingPublisherContext } from '~wildo-frontend-lib/core/i18n/I18nContext';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\nconst logDebug: (message: string, context?: Record<string, unknown>) => void = logger.debugByType('UserOrgsContext');\nlogger.setDebugTypeLogging('UserOrgsContext', false);\n\n/*\n Session-restore retry backoff bounds (transient backend failures only).\n \n On RELOAD, a backend that is recompiling/restarting (dev) or briefly\n * unavailable (prod) makes the session-restore fetch fail transiently. Rather\n * than force a logout — which clears the shared `__wildo_refresh` cookie and\n * drops the user to the login screen — restore preserves the session and\n * retries with exponential backoff until the backend returns. Genuine auth/authz\n * and non-network errors do NOT retry (see `restoreSession`). Backoff caps so a\n * sustained outage settles at one attempt per {@link RESTORE_RETRY_MAX_DELAY_MS}.\n /\nconst RESTORE_RETRY_BASE_DELAY_MS = 1_000;\nconst RESTORE_RETRY_MAX_DELAY_MS = 30_000;\n\n/\n User Organizations Context\n * Manages user data, organizations, permissions, and preferences\n * Consumes AuthSessionContext for authentication state\n /\n\nexport interface UserOrgsContextType {\n // Re-exported from AuthSession for backward compatibility\n auth: ReturnType<typeof useAuthSession>['auth'];\n identifyByEmail: ReturnType<typeof useAuthSession>['identifyByEmail'];\n authenticateWithPassword: ReturnType<typeof useAuthSession>['authenticateWithPassword'];\n authenticate: ReturnType<typeof useAuthSession>['authenticate'];\n getSessionState: ReturnType<typeof useAuthSession>['getSessionState'];\n isAuthenticated: ReturnType<typeof useAuthSession>['isAuthenticated'];\n logout: () => void;\n restoreSession: () => Promise<boolean>;\n\n // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n initiateOAuth2Login: ReturnType<typeof useAuthSession>['initiateOAuth2Login'];\n handleAuthCodeExchange: ReturnType<typeof useAuthSession>['handleAuthCodeExchange'];\n\n // User data\n user: UserContext \| null;\n\n // Organization data\n organizations: OrganizationContext[];\n currentOrganizationId: string \| null;\n permissions: EffectivePermissions \| null;\n primaryScopeInitiatorIds: ExecutionContext_InitiatorIds \| null;\n\n // Privacy (only preference managed here, others are in their respective contexts)\n privacy: UserPrivacy \| null;\n\n // Organization management\n /\n The person's own choice of organization (the organization switcher). An organization this session loaded, or one\n * the backend's access profile confers entries in, which the switcher found by search past the user context's first\n * 20 memberships (#2452); that one is loaded on demand. Anything else is refused (logged, nothing changes).\n /\n setCurrentOrganization: (organizationId: string) => void;\n /\n Make the organization the current route names the session's current one (#2247). See\n * `RouteOrganizationFollow` for why the route is the authority. Refuses (returns `false`, changes nothing) unless\n * the session can be IN it: an ACTIVE membership the client vouches for (the predicate the route's access verdict\n * uses), or an organization this session loaded (what the switcher offers). Refuses in a one-off session too,\n * whose token the server bound to one organization. Called by `AppLayout_AuthenticatedRoute`.\n /\n followRouteOrganization: (organizationId: string) => boolean;\n getCurrentOrganization: () => OrganizationContext \| null;\n refreshOrganizations: () => Promise<void>;\n\n // Privacy getter\n getPrivacy: () => UserPrivacy \| null;\n\n /\n Record the signed-in person's consent decision: exactly the purposes they granted (#534).\n \n The argument is the WHOLE granted set, never a delta — a purpose left out is a purpose not granted,\n * so an unticked box is a withdrawal rather than \"no change\". The write always carries a decision\n * claim, which is what lets \"grant nothing\" be recorded as a decision instead of reading as a person\n * who was never asked; the recorded instant is the server's (`buildConsentDecisionPatch`).\n \n Resolves with the stored privacy block once it is in state, so a caller gating on consent (the\n * consent gate) sees the new decision on the next render. Rejects when the application mounts no\n * self-preferences UPDATE door or the write fails — a consent surface must say it could not save,\n * never behave as though it had.\n /\n recordConsentDecision: (grantedPurposes: readonly ConsentPurpose[]) => Promise<UserPrivacy>;\n}\n\n/\n UserOrgs Context\n * Exported for use in separate hook file (Fast Refresh compatibility)\n * @internal - Use useUserOrgs() hook instead of accessing this directly\n /\nexport const UserOrgsContext: React.Context<UserOrgsContextType \| undefined> = createContext<UserOrgsContextType \| undefined>(undefined);\n\nexport const UserOrgsProvider: React.FC<{ children: ReactNode }> = ({ children }) => {\n const { doOperation, registry } = useResourceRegistry();\n const { emit } = useEventBus();\n\n // Consume auth session context\n const authSession = useAuthSession();\n const {\n auth,\n tokenStorage,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout: authLogout,\n endSession,\n getSessionEstablishment,\n getSessionEndReason,\n initiateOAuth2Login,\n handleAuthCodeExchange,\n markSessionRestored,\n setSessionRestoring,\n connectWebSocket,\n } = authSession;\n const appScope = useAppScope();\n const { commitOrganizationScopeValue } = useAppScopeInternal();\n const currentOrganizationId = appScope.currentOrganizationId;\n // Read by `loadOrganizations` at the moment it settles, not when it was created: it awaits network reads.\n const currentOrganizationIdRef = useRef(currentOrganizationId);\n currentOrganizationIdRef.current = currentOrganizationId;\n\n const hasInitializedRef = useRef(false);\n const previousTokenRef = useRef<string \| null>(null);\n // Restore-retry lifecycle: `restoreAbortRef` flips true on unmount so an\n // in-flight backoff loop bails instead of touching state on a dead component;\n // `restoreRetryTimerRef` holds the pending backoff timer for cleanup.\n const restoreAbortRef = useRef(false);\n const restoreRetryTimerRef = useRef<ReturnType<typeof setTimeout> \| null>(null);\n\n const [user, setUser] = useState<UserContext \| null>(null);\n // The person loaded now, read by work that settles after an await (an organization loaded on demand, #2275).\n const loadedUserIdRef = useRef<string \| null>(null);\n loadedUserIdRef.current = user?._id ?? null;\n\n const [organizations, setOrganizations] = useState<OrganizationContext[]>([]);\n\n const [permissions, setPermissions] = useState<EffectivePermissions \| null>(null);\n\n const [privacy, setPrivacy] = useState<UserPrivacy \| null>(null);\n\n type PreferencesPayload = Pick<UserPreferences, 'languagePreferences' \| 'regional' \| 'ui' \| 'notifications' \| 'privacy'>;\n\n /\n The TENANT's half of the payload, derived from its preferences record rather than passed\n * alongside it (#410).\n \n The organization contributes two things to `I18nContext` — its language policy and its regional\n * defaults — and they are forwarded together because they come from one record. An earlier shape\n * took the language block as its own argument, and when the regional half was added every call\n * site would have had to remember to forward a second one: three sites, one obligation each, and\n * a fourth site tomorrow that forwards neither. Passing the record makes forgetting impossible.\n /\n const organizationPreferencesPayload = (\n organizationPreferences: OrganizationContext['preferences'] \| null \| undefined,\n ): Record<string, unknown> => {\n if (organizationPreferences === undefined) {\n return {};\n }\n if (organizationPreferences === null) {\n return { organizationLanguagePreferences: null, organizationRegionalPreferences: null };\n }\n return {\n organizationLanguagePreferences: organizationPreferences.languagePreferences ?? null,\n organizationRegionalPreferences: {\n timezone: organizationPreferences.timezone,\n locale: organizationPreferences.locale,\n dateFormat: organizationPreferences.dateFormat,\n timeFormat: organizationPreferences.timeFormat,\n },\n };\n };\n\n const emitPreferencesChanged = useCallback((\n preferences: PreferencesPayload \| null \| undefined,\n organizationPreferences?: OrganizationContext['preferences'] \| null,\n ): void => {\n if (preferences === null) {\n emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n languagePreferences: null,\n organizationLanguagePreferences: null,\n regionalPreferences: null,\n organizationRegionalPreferences: null,\n notificationsPreferences: null,\n uiPreferences: null,\n privacy: null,\n });\n return;\n }\n\n emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n ...(preferences?.languagePreferences !== undefined ? { languagePreferences: preferences.languagePreferences } : {}),\n ...organizationPreferencesPayload(organizationPreferences),\n ...(preferences?.regional !== undefined ? { regionalPreferences: preferences.regional } : {}),\n ...(preferences?.notifications !== undefined ? { notificationsPreferences: preferences.notifications } : {}),\n ...(preferences?.ui !== undefined ? { uiPreferences: preferences.ui } : {}),\n ...(preferences?.privacy !== undefined ? { privacy: preferences.privacy } : {}),\n });\n }, [emit]);\n\n /\n * `USER_LOGIN` / `USER_LOGOUT` — announced HERE, once per transition of the known person (#1977).\n \n Nothing emitted them before, so every listener — error-report attribution, analytics identify and\n * reset, the sign-in and sign-out analytics events — was dead code that read as if sign-in were\n * observed. This is the one place every sign-in method and every way a session ends converge: each\n * authentication stores a token, the auto-load effect below restores the user from it, and every\n * sign-out, refused refresh, failed restore and cross-tab sign-out clears the token, which clears the\n * user. Emitting at each auth method instead would be a dozen call sites, and the next method added\n * would be the one that forgot. Declared BEFORE the preferences effect, because effects run in\n * declaration order and a person's arrival must precede their preferences.\n \n The id last announced is the guard, so a re-render, a preferences write that replaces the user\n * object, or StrictMode re-running an effect announces nothing, and a direct switch from one person to\n * another announces the first one's departure before the second one's arrival. HOW the session began\n * and WHY it ended are recorded by `AuthSessionProvider`, the only code that knows, and read at the\n * moment of announcing.\n \n A DEPARTURE is announced by the two places that clear the user, BEFORE they publish `privacy: null`:\n * a listener that must act while the person's consent still holds (the sign-out analytics event, sent\n * before the destinations are reset) needs the announcement first, and the consent-based providers\n * stop on the `privacy: null` that follows. The effect announces ARRIVALS, and a departure only as a\n * backstop for a path that cleared the user without announcing. An unmount announces nothing: the\n * provider going away is not the person signing out.\n /\n const announcedUserIdRef = useRef<string \| null>(null);\n const announceDeparture = useCallback((reason: SessionEndReason): void => {\n const departedUserId = announcedUserIdRef.current;\n if (departedUserId === null) return;\n announcedUserIdRef.current = null;\n emit(FrontendEvents.USER_LOGOUT, { userId: departedUserId, reason });\n }, [emit]);\n const knownUserId = user?._id ?? null;\n useEffect(() => {\n const previousUserId = announcedUserIdRef.current;\n if (previousUserId === knownUserId) return;\n if (previousUserId !== null && knownUserId !== null) {\n /\n * One person REPLACED by another with no sign-out between them. Believed unreachable today: a sign-in\n * while someone is loaded sets `isRestoringSession` with `hasInitializedRef` already true, so the\n * auto-load effect below skips it, and `restoreSession` returns early while a user is loaded. Handled\n * anyway, because the consequence of getting it wrong is the next person's analytics running under\n * the previous person's consent: the departure is followed by the same `privacy: null` a sign-out\n * publishes, BEFORE the arrival, so the next person is judged on their own preferences, which the\n * preferences effect below publishes after this one.\n /\n announceDeparture(SessionEndReason.REPLACED);\n setPrivacy(null);\n emitPreferencesChanged(null);\n } else if (previousUserId !== null) {\n announceDeparture(getSessionEndReason());\n }\n if (knownUserId !== null) {\n announcedUserIdRef.current = knownUserId;\n emit(FrontendEvents.USER_LOGIN, { userId: knownUserId, establishment: getSessionEstablishment() });\n }\n }, [knownUserId, emit, announceDeparture, emitPreferencesChanged, getSessionEndReason, getSessionEstablishment]);\n\n const primaryScopeInitiatorIds = useMemo<ExecutionContext_InitiatorIds \| null>(() => {\n return ScopeUtilsService.buildInitiatorIds({\n userId: appScope.currentUserId,\n organizationId: appScope.currentOrganizationId,\n applicationId: appScope.currentApplicationId,\n anonymousUserId: appScope.currentAnonymousUserId,\n });\n }, [\n appScope.currentApplicationId,\n appScope.currentAnonymousUserId,\n appScope.currentOrganizationId,\n appScope.currentUserId,\n ]);\n\n /\n Extract and store user preferences from context\n * Stores preferences in state for other contexts to read and apply\n /\n const storePreferences = useCallback((\n preferences: PreferencesPayload,\n organizationPreferences?: OrganizationContext['preferences'] \| null,\n ): void => {\n // Store privacy preferences in state\n if (preferences.privacy) {\n setPrivacy(preferences.privacy);\n }\n\n const currentOrganizationPreferences = organizationPreferences !== undefined\n ? organizationPreferences\n : currentOrganizationId\n ? organizations.find((organization) => organization._id === currentOrganizationId)?.preferences\n : undefined;\n\n // Emit preference change event to notify parent contexts\n emitPreferencesChanged(\n preferences,\n currentOrganizationPreferences,\n );\n }, [currentOrganizationId, emitPreferencesChanged, organizations]);\n\n /\n The caller's access profile (`user-self \| access_profile`, #2381) — the role entries the backend authorizes this\n * person with, unit and relationship grants included, and which resources narrow by unit. The shell's\n * visibility decisions read it (`viewerMayPerformOperation`). `null` when the operation is absent or the read fails.\n \n The route names no user: the backend answers from the request's own execution context, so it can only ever describe\n * the person asking (`GET /user-self/access-profile/count`).\n /\n const loadAccessProfile = async (): Promise<UserSelfAccessProfile \| null> => {\n const userSelfConfig = registry.resourceConfigurations[CoreResourceType.USER_SELF];\n const accessProfileOperation = userSelfConfig?.operations.find((op: any) =>\n op.operationIdentifier === UserSelf_Operations.ACCESS_PROFILE &&\n op.variantType === ResourceOperationVariantType.API_CALL &&\n op.isBulkOperation !== true\n );\n if (!accessProfileOperation) return null;\n try {\n const operationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(accessProfileOperation);\n return (await doOperation<UserSelfAccessProfile>(operationPath, { contextualParameters: {} })) ?? null;\n } catch (error) {\n logger.warn('Access profile could not be loaded; entries reached only through an organization-unit grant stay hidden', { error });\n return null;\n }\n };\n\n /\n Compute effective permissions from user's app roles and organization roles\n * This is a basic implementation - can be enhanced based on role hierarchy\n /\n const computeEffectivePermissions = (\n userContext: UserContext,\n organizationsList: OrganizationContext[]\n ): EffectivePermissions \| null => {\n // App-level permissions from user's app roles\n const appLevel = (userContext.appRoles \|\| []) as string[];\n\n // Per-organization permissions from organization membership roles\n // Use new field name from relationship-based context\n const organizationsPermissions: Record<string, string[]> = {};\n const memberships = userContext.organizationMembers \|\| [];\n\n for (const membership of memberships) {\n organizationsPermissions[membership.organizationId] = (membership.roles \|\| []) as string[];\n }\n\n return {\n appLevel,\n organizations: organizationsPermissions,\n accessProfile: null,\n };\n };\n\n /\n One of the person's own organizations, as the session holds it: the organization READ and, beside it, the tenant's\n * preference record. `null` when the organization cannot be read (a refusal, a transient failure, no READ mounted).\n \n Shared by `loadOrganizations` (the memberships the user context carries) and by the organizations loaded ON\n * DEMAND (#2275): a membership past the user context's cap that the session follows or starts in. Both must hold\n * the organization the same way, or the switcher and the i18n preferences would differ by how it arrived.\n /\n const fetchOwnOrganization = useCallback(async (organizationId: string): Promise<OrganizationContext \| null> => {\n const organizationsConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];\n if (!organizationsConfig) {\n logger.warn('ORGANIZATIONS resource not available');\n return null;\n }\n // Shared with the route organization-access probe, which must address the same READ.\n const orgsReadOp = findDefaultApiReadOperation(organizationsConfig);\n if (!orgsReadOp) {\n logger.warn('ORGANIZATIONS READ operation not found');\n return null;\n }\n const organizationsOperationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(orgsReadOp);\n\n /\n The tenant's preference record is fetched SEPARATELY, and that is a decision rather than an\n * omission (#563).\n \n `OrganizationContextSchema` declares `preferences`, and `doOperation<OrganizationContext>`\n * is a CAST — nothing validates the response against it — so the field read as available\n * while no producer existed: the ORGANIZATIONS default READ returns a plain\n * `Organization`, and the organisation's regional block therefore never reached\n * `I18nContext`. Every date and number in every generated application formatted at the\n * framework floor as a result.\n \n The rejected alternative was to switch this call to the ORGANIZATIONS context variant,\n * which does populate the child. Measured against the running stack on 2026-09-10, that\n * response carries every context-enabled child of an organisation — `auditLogs`, `todos`,\n * `tasks`, `knowledgeDocuments`, `organizationMembers`, … — so session restore would pull an\n * unbounded page of tenant data per membership to obtain four regional fields. (#583 has since\n * taken the audit and delivery logs off the context surface and capped every 1:many child at\n * `contextPolicy.limit`, 20 by default. The page is bounded now, but it is still a page of tenant\n * data per membership, so the reasoning stands.) The\n * preference record has its own default READ (`GET /organizations/{id}/organization-preference`,\n * reachable by an ordinary `ORG_MEMBER`), which is one small request with a stable shape.\n \n Best-effort by construction: a tenant whose preferences cannot be read still yields a\n * usable organisation, and `organizationPreferencesPayload(undefined)` then contributes\n * nothing to the i18n event rather than clearing the member's own settings.\n /\n const organizationPreferencesReadOp = findDefaultApiReadOperation(registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES]);\n const fetchOrganizationPreferences = async (): Promise<OrganizationContext['preferences'] \| undefined> => {\n // Absent READ: reported once per list load by `loadOrganizations`, not once per organization.\n if (!organizationPreferencesReadOp) return undefined;\n try {\n return await doOperation<NonNullable<OrganizationContext['preferences']>>(\n ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(organizationPreferencesReadOp),\n { contextualParameters: { organizationId } },\n ) ?? undefined;\n } catch (error) {\n logger.warn('Failed to fetch organization preferences', { organizationId, error });\n return undefined;\n }\n };\n\n try {\n const [org, preferences] = await Promise.all([\n doOperation<OrganizationContext>(organizationsOperationPath, { contextualParameters: { organizationId } }),\n fetchOrganizationPreferences(),\n ]);\n if (!org) return null;\n // OMIT the key when the read failed rather than attaching `null`. The payload builder\n // reads the two differently: `undefined`/absent contributes nothing to the i18n event,\n // while `null` means \"the tenant has cleared its preferences\" and actively resets the\n // organisation half — which would silently downgrade a member to the framework floor\n // because one request failed.\n return preferences ? { ...org, preferences } : org;\n } catch (error) {\n logger.warn('Failed to fetch organization', { organizationId, error });\n return null;\n }\n }, [doOperation, registry]);\n\n /\n Load one of the person's own organizations the session does not hold yet, and add it to `organizations` (#2275,\n * #2452): one followed by route, or one the switcher found by search past the user context's first 20 memberships.\n * One path for both, so an organization arrives the same way whichever door admitted it. A sign-out or another\n * person's sign-in while the read was in flight must not receive this person's organization.\n /\n const loadOrganizationOnDemand = useCallback((organizationId: string): void => {\n const requestingUserId = loadedUserIdRef.current;\n void fetchOwnOrganization(organizationId).then((organization) => {\n if (!organization \|\| loadedUserIdRef.current !== requestingUserId) return;\n setOrganizations((previous) => previous.some((existing) => existing._id === organization._id) ? previous : [...previous, organization]);\n });\n }, [fetchOwnOrganization]);\n\n /\n Load organizations independently (can be called separately from authentication)\n /\n const loadOrganizations = useCallback(async (userContext: UserContext): Promise<{\n organizationsList: OrganizationContext[];\n selectedOrgId: string \| null;\n }> => {\n // The backend's own account of this person's access (#2381), fetched beside the organizations rather than after\n // them. Best-effort: a failure leaves the shell deciding on membership roles alone (unit-granted entries hidden).\n const accessProfilePromise = loadAccessProfile();\n const allMemberships = userContext.organizationMembers \|\| [];\n\n // W7.3b: For one-off sessions, restrict to the scoped organization only\n const scopedOrgId = auth.sessionType === SessionType.ONE_OFF\n ? tokenStorage.getOrganizationId()\n : null;\n\n const memberships = scopedOrgId\n ? allMemberships.filter((m: any) => m.organizationId === scopedOrgId)\n : allMemberships;\n\n logDebug('Loading organizations', {\n userId: userContext._id,\n membershipCount: memberships.length,\n isOneOff: auth.sessionType === SessionType.ONE_OFF,\n });\n\n if (!findDefaultApiReadOperation(registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES])) {\n logger.warn('ORGANIZATION_PREFERENCES READ operation not found — tenant regional defaults will not be applied');\n }\n const organizationsList: OrganizationContext[] = [];\n const membershipOrganizationResults = await Promise.all(\n memberships.map((membership: any) => fetchOwnOrganization(String(membership.organizationId))),\n );\n organizationsList.push(...membershipOrganizationResults.filter((org): org is OrganizationContext => org !== null));\n\n // Keep the organization this tab is IN when it is still one of the person's (#2247): a reload of the list\n // (`refreshOrganizations`, e.g. after accepting an invitation) must not move the tab. The stored value is\n // shared by every tab and follows each tab's route, so reading it here would pull this tab into whatever\n // organization another tab last opened, and the switch would send it home. The stored value is the default a\n // session STARTS from (during restore AppScope exposes no organization yet, so it is the one used), then the\n // first organization.\n const tabOrgId = currentOrganizationIdRef.current;\n const storedOrgId = tokenStorage.getOrganizationId();\n const isLoaded = (organizationId: string \| null): organizationId is string =>\n !!organizationId && organizationsList.some(o => o._id === organizationId);\n const accessProfile = await accessProfilePromise;\n\n // The organization the tab is in, or the session starts from, may be one the user context does not carry: its\n // `organizationMembers` holds only the newest 20 memberships (#2275), and since #2247 the tab's and the stored\n // organization follow the route, so they are often one past that cap. When the backend's access profile confers\n // entries there, it is one of the person's own and is loaded on demand like the others; without that, a reload\n // of the list would move the tab out of the organization its page names, and a new session would never start\n // where the person last was. In a one-off session only the organization its token is bound to is ever loaded.\n const preferredOrgId = tabOrgId ?? storedOrgId;\n if (\n preferredOrgId\n && !isLoaded(preferredOrgId)\n && (!scopedOrgId \|\| preferredOrgId === scopedOrgId)\n && accessProfileConfersOrganization(accessProfile, preferredOrgId)\n ) {\n const preferredOrganization = await fetchOwnOrganization(preferredOrgId);\n if (preferredOrganization) organizationsList.push(preferredOrganization);\n }\n\n const selectedOrgId = isLoaded(tabOrgId)\n ? tabOrgId\n : isLoaded(storedOrgId)\n ? storedOrgId\n : organizationsList[0]?._id \|\| null;\n\n // Compute effective permissions. With the backend's access profile, the roles are the ones the backend confers\n // (`membershipRolesFromAccessProfile`); without it, the membership rows decide, as before.\n const membershipPermissions = computeEffectivePermissions(userContext, organizationsList);\n const computedPermissions = membershipPermissions\n ? { ...membershipPermissions, ...(accessProfile ? membershipRolesFromAccessProfile(accessProfile) : {}), accessProfile }\n : null;\n\n setOrganizations(organizationsList);\n commitOrganizationScopeValue(selectedOrgId);\n setPermissions(computedPermissions);\n\n logDebug('Organizations loaded', { organizationCount: organizationsList.length, currentOrganizationId: selectedOrgId });\n return { organizationsList, selectedOrgId };\n }, [commitOrganizationScopeValue, fetchOwnOrganization, registry, tokenStorage, auth.sessionType]);\n\n /\n Restore regular user session\n /\n const restoreUserSession = useCallback(async (accessToken: string): Promise<boolean> => {\n logDebug('Restoring user session');\n\n // Check if USER_SELF is available\n const availableResources = Object.keys(registry.resourceConfigurations);\n const hasUserSelf = availableResources.includes(CoreResourceType.USER_SELF);\n\n if (!hasUserSelf) {\n logger.warn('USER_SELF resource not available for session restoration');\n return false;\n }\n\n // Get USER_SELF resource config\n const userSelfConfig = registry.resourceConfigurations[CoreResourceType.USER_SELF];\n\n const readOperation = findDefaultApiReadOperation(userSelfConfig);\n\n if (!readOperation) {\n logger.warn('USER_SELF READ operation not found');\n return false;\n }\n\n // Find context variant (auto-generated with relationship population)\n const readContextOp = userSelfConfig.operations.find((op: any) =>\n op.operationIdentifier === CoreResourceOperation.READ &&\n op.isBulkOperation !== true &&\n op.variantType === ResourceOperationVariantType.API_CALL &&\n op.variantKey === OPERATION_VARIANT_KEY.CONTEXT\n );\n\n if (!readContextOp) {\n logger.warn('USER_SELF context variant not found');\n return false;\n }\n\n const initiatorInfo = readOperation.initiatorInfos?.[0];\n const requiresUserId = initiatorInfo?.parameters?.some((p: any) => p.fieldIdentifier === 'userId');\n\n const contextualParameters: Record<string, string> = {};\n\n if (requiresUserId && accessToken) {\n try {\n const payload = decodeJwtPayload<{ userId?: string }>(accessToken);\n if (payload.userId) {\n contextualParameters.userId = payload.userId;\n }\n } catch (e) {\n logDebug('Failed to decode JWT for userId extraction', { error: e });\n }\n }\n\n // Build operation path and fetch user context\n const contextPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readContextOp);\n const userContext = await doOperation<UserContext>(contextPath, { contextualParameters });\n\n if (!userContext) {\n logger.warn('Failed to fetch user context during session restoration');\n return false;\n }\n\n // Use new field name from relationship-based context\n const membershipsCount = (userContext.organizationMembers \|\| []).length;\n logDebug('User context restored', { userId: userContext._id, organizationCount: membershipsCount });\n\n // Update user state\n setUser(userContext);\n\n // Load organizations separately\n // If this fails, session restoration still succeeds (user context is restored)\n const { organizationsList, selectedOrgId } = await loadOrganizations(userContext);\n\n // Store preferences after organization loading so i18n receives user and\n // active-organization language policy in the same event.\n const preferences = userContext.userSelfPreferences;\n if (preferences) {\n const currentOrganization = selectedOrgId\n ? organizationsList.find((organization) => organization._id === selectedOrgId)\n : null;\n storePreferences(preferences, currentOrganization?.preferences);\n }\n\n logger.info('Session restored successfully', {\n userId: userContext._id,\n organizationCount: membershipsCount\n });\n\n return true;\n }, [doOperation, registry, loadOrganizations, storePreferences]);\n\n // Stop any pending restore-retry backoff when the provider unmounts, so the\n // loop in `restoreSession` bails instead of calling setState on a dead tree.\n useEffect(() => {\n restoreAbortRef.current = false;\n return () => {\n restoreAbortRef.current = true;\n if (restoreRetryTimerRef.current) {\n clearTimeout(restoreRetryTimerRef.current);\n restoreRetryTimerRef.current = null;\n }\n };\n }, []);\n\n /\n Restore session from stored JWT token\n * Fetches user context using USER_SELF resource (userId comes from JWT)\n * Then fetches full organization details for each organization membership\n \n Resilience: a TRANSIENT backend failure (unreachable / 5xx / timeout, or a\n * 401 whose in-flight renewal failed transiently) does NOT log out — restore\n * preserves the session and retries with capped exponential backoff until the\n * backend returns. Genuine authentication (401), authorization (403), and\n * non-network errors terminate immediately (no retry on a dead-or-buggy path).\n /\n const runSessionRestore = useCallback(async (): Promise<boolean> => {\n logDebug('Restoring session from stored token');\n\n // Check if session is already restored to avoid duplicate restoration attempts\n if (auth.sessionRestored && auth.accessToken && user) {\n logDebug('Session already restored, skipping restoration');\n return true;\n }\n\n // Read token from auth state\n const accessToken = auth.accessToken;\n\n if (!accessToken) {\n logDebug('No access token available');\n return false;\n }\n\n setSessionRestoring(true);\n\n let attempt = 0;\n // Single backoff loop: the invoking effect won't re-enter while\n // `isRestoringSession` is true, so this is the sole restore in flight.\n while (true) {\n try {\n const restored = await restoreUserSession(accessToken);\n\n if (restored) {\n markSessionRestored();\n\n // W7.3b: One-off sessions already connected WebSocket in handleOneOffTokenExchange\n // (with consumableToken). Reconnecting here would lose the consumable token.\n if (auth.sessionType !== SessionType.ONE_OFF) {\n // Connect with the FRESHEST token, read live from storage — NOT the\n // `accessToken` captured at the top of `restoreSession`. During the\n // awaited `restoreUserSession` above, the HTTP interceptor may have\n // hit a `401 OUTDATED_AUTH_JWT` and rotated the token via\n // `tokenRenewalHandler` (which writes the new token to storage AND\n // seeds the WS `authStateRef` synchronously). The captured\n // `accessToken` is then stale/expired; passing it into `connect()`\n // reseeds the WS credential source-of-truth back to the expired token\n // (clobbering the fresh one the refresh just stored), and the Socket.IO\n // handshake gets rejected with \"Authentication failed\". `getAccessToken()`\n // returns the live, post-refresh value (falling back to the captured\n // token only if storage is somehow empty).\n const freshestAccessToken = tokenStorage.getAccessToken() ?? accessToken;\n connectWebSocket(freshestAccessToken, tokenStorage.getOrganizationId());\n }\n } else {\n logger.warn('Session restoration could not build a valid authenticated context; logging out to avoid a half-restored state');\n endSession(SessionEndReason.SESSION_ENDED);\n }\n\n return restored;\n\n } catch (error: any) {\n // Authorization (403 / scope) is checked FIRST and is non-destructive: a\n // permission denial must NEVER destroy a valid session. Authentication\n // (401 / session-invalid) is the only branch that force-logs-out.\n // `isAuthenticationError` already excludes authorization errors (see\n // `AuthSessionUtils`), so these are mutually exclusive — the explicit\n // ordering here is defense-in-depth so the non-destructive path wins even\n // if that guard is ever loosened.\n const isAuthorizationError = AuthSessionUtils.isAuthorizationError(error);\n\n if (isAuthorizationError) {\n const errorMessage = error?.message \|\| 'Session restoration blocked by authorization';\n logger.warn('Session restoration encountered authorization/scope error', {\n error: errorMessage,\n errorType: error?.wildoError?.type \|\| error?.response?.data?.error?.type,\n status: error?.response?.status,\n });\n setSessionRestoring(false);\n markSessionRestored();\n return false;\n }\n\n // TRANSIENT backend failure (checked BEFORE the authentication branch so\n // a 401 whose renewal failed transiently is retried, not logged out):\n // preserve the session, back off, and retry. Bail if the component\n // unmounted or the session was cleared (logout elsewhere) while waiting.\n if (isTransientBackendFailure(error)) {\n attempt += 1;\n const delay = Math.min(\n RESTORE_RETRY_BASE_DELAY_MS 2 (attempt - 1),\n RESTORE_RETRY_MAX_DELAY_MS,\n );\n logger.warn('Session restoration hit a transient backend failure; preserving session and retrying', {\n attempt,\n retryInMs: delay,\n status: error?.response?.status,\n code: error?.code,\n });\n await new Promise<void>((resolve) => {\n restoreRetryTimerRef.current = setTimeout(resolve, delay);\n });\n if (restoreAbortRef.current \|\| !tokenStorage.getAccessToken()) {\n setSessionRestoring(false);\n return false;\n }\n continue;\n }\n\n if (AuthSessionUtils.isAuthenticationError(error)) {\n logDebug('Session restoration failed due to authentication error', {\n errorType: error?.wildoError?.type \|\| error?.response?.data?.error?.type,\n status: error?.response?.status,\n });\n // Usually the refresh already ended it, naming why; when restore is first, it reads the refusal itself.\n endSession(sessionEndReasonForRefusal(error));\n return false;\n }\n\n // Fail closed on unexpected NON-transient errors. A partially restored\n // authenticated shell is less safe than dropping back to a clean login.\n const errorMessage = error?.message \|\| 'Session restoration failed';\n logger.warn('Session restoration encountered a non-transient error; logging out', {\n error: errorMessage,\n errorType: error?.wildoError?.type,\n });\n\n endSession(SessionEndReason.SESSION_ENDED);\n return false;\n }\n }\n }, [\n restoreUserSession,\n auth.sessionRestored,\n auth.sessionType,\n auth.accessToken,\n user,\n endSession,\n markSessionRestored,\n setSessionRestoring,\n connectWebSocket,\n tokenStorage\n ]);\n\n /\n * The access token the last restore CONCLUDED for, whatever its outcome (#2242).\n \n \"A token and no user\" is two different states, and the reader standing must tell them apart: before a\n * restore has run for this token (every returning visitor's first render, and a one-off session, which\n * starts with `sessionRestored: true` and no user) it is UNSETTLED; after a restore concluded without a\n * user (the authorization-error branch keeps the token) it is settled with no person. Neither\n * `isRestoringSession` nor `sessionRestored` says which — so the restore records it. Keyed by the token\n * LIVE at the end, since a restore may rotate it mid-flight.\n /\n const [restoreConcludedForToken, setRestoreConcludedForToken] = useState<string \| null>(null);\n const restoreSession = useCallback(async (): Promise<boolean> => {\n try {\n return await runSessionRestore();\n } finally {\n const settledToken = tokenStorage.getAccessToken();\n if (settledToken) setRestoreConcludedForToken(settledToken);\n }\n }, [runSessionRestore, tokenStorage]);\n\n /\n Refresh organizations data (e.g., after organization update)\n /\n const refreshOrganizations = useCallback(async (): Promise<void> => {\n // Use new field name from relationship-based context\n const memberships = user?.organizationMembers \|\| [];\n\n if (memberships.length === 0) {\n logDebug('No organizations membership to refresh');\n return;\n }\n\n logDebug('Refreshing organizations', { membershipCount: memberships.length });\n\n // Use loadOrganizations to refresh\n await loadOrganizations(user!);\n }, [user, loadOrganizations]);\n\n useEffect(() => {\n if (!user?.userSelfPreferences) {\n return;\n }\n\n const currentOrganization = currentOrganizationId\n ? organizations.find((organization) => organization._id === currentOrganizationId)\n : null;\n\n emitPreferencesChanged(\n user.userSelfPreferences,\n currentOrganization?.preferences,\n );\n }, [currentOrganizationId, emitPreferencesChanged, organizations, user]);\n\n /\n * Whether anybody is reading, published to `I18nContext` (#2242). It mounts above this provider, so a null\n * member and a null organization are all it can see — the same for an anonymous visitor as for a member\n * being restored, and only the first should have the browser stand in for their preferences.\n \n Through `RegionalReaderStandingPublisherContext`, never the bus: `I18nProvider` is our ancestor, so its\n * bus subscription is made AFTER our mount effect runs, and an emission there is lost (see the context's\n * JSDoc). ONE effect, deriving from the session rather than riding each preference emission above: every\n * way a session starts or ends changes one of these inputs, so none can forget to say it. Declared AFTER\n * the preferences effect so a member's SIGNED_IN follows their preferences in the same commit; the restore\n * path stores them before `isRestoringSession` clears, so it is ordered by the derivation itself.\n /\n const publishRegionalReaderStanding = useContext(RegionalReaderStandingPublisherContext);\n const regionalReaderStanding = deriveRegionalReaderStanding({\n isRestoringSession: auth.isRestoringSession,\n hasUser: user !== null,\n hasAccessToken: Boolean(auth.accessToken),\n restoreConcludedForAccessToken: Boolean(auth.accessToken) && restoreConcludedForToken === auth.accessToken,\n });\n useEffect(() => {\n publishRegionalReaderStanding?.(regionalReaderStanding);\n }, [publishRegionalReaderStanding, regionalReaderStanding]);\n\n /\n Set the current active organization\n /\n const setCurrentOrganization = useCallback((organizationId: string): void => {\n const org = organizations.find(o => o._id === organizationId);\n // An organization the switcher FOUND by search rather than one it loaded (#2452): past the user context's first\n // 20 memberships. Admitted on the same fact `followRouteOrganization` admits it on — the backend's access profile\n // confers entries there — and loaded on demand like a followed one, so the switcher and the tenant's preferences\n // hold it the same way. Never in a one-off session, whose token the server bound to one organization.\n const conferred = !org\n && auth.sessionType !== SessionType.ONE_OFF\n && accessProfileConfersOrganization(permissions?.accessProfile, organizationId);\n if (!org && !conferred) {\n logger.warn('Attempted to set invalid organization', { organizationId, availableOrganizations: organizations.map(o => o._id) });\n return;\n }\n if (conferred) loadOrganizationOnDemand(organizationId);\n\n const previousOrganizationId = currentOrganizationId;\n\n // Skip if the organization hasn't changed\n if (previousOrganizationId === organizationId) {\n return;\n }\n\n logDebug('Setting current organization', { organizationId, organizationName: org?.name, previousOrganizationId, loadedOnDemand: conferred });\n commitOrganizationScopeValue(organizationId, ScopeChangeInitiator.USER_SELECTION);\n }, [auth.sessionType, organizations, permissions, currentOrganizationId, commitOrganizationScopeValue, loadOrganizationOnDemand]);\n\n /\n Follow the organization the route names (#2247).\n \n Three facts admit it, matching the route verdicts the follow acts on. An ACTIVE membership the client vouches for\n * is what `ACTIVE_MEMBERSHIP` rests on, so the two cannot disagree. An organization in `organizations` is one this\n * session loaded from its own memberships and offers in the switcher; it is what admits a representative member\n * (#1597), whose membership the client deliberately never vouches for and the server `ADMITTED`. An organization the\n * backend's access profile confers entries in is a membership past the user context's cap of 20 (#2275), which the\n * server also `ADMITTED`: it is loaded on demand, so the switcher and the tenant's preferences hold the organization\n * the person is in. Anything else — a platform operator's crossing, a foreign organization — is refused.\n \n The commit does not wait for that load. The roles the page is judged by come from the access profile, which is\n * already held, and holding the route's content until a second read lands would only delay a page that can render.\n /\n const followRouteOrganization = useCallback((organizationId: string): boolean => {\n if (auth.sessionType === SessionType.ONE_OFF) {\n return false;\n }\n const loaded = organizations.some((organization) => organization._id === organizationId);\n const conferred = accessProfileConfersOrganization(permissions?.accessProfile, organizationId);\n const sessionCanBeIn = hasActiveMembershipInOrganization(user?.organizationMembers, organizationId) \|\| loaded \|\| conferred;\n if (!sessionCanBeIn) {\n logger.warn('Refused to follow a route organization this session cannot be in', { organizationId });\n return false;\n }\n if (!loaded) loadOrganizationOnDemand(organizationId);\n if (currentOrganizationId !== organizationId) {\n logDebug('Following the route organization', { organizationId, previousOrganizationId: currentOrganizationId });\n commitOrganizationScopeValue(organizationId, ScopeChangeInitiator.ROUTER);\n }\n return true;\n }, [auth.sessionType, user, organizations, permissions, currentOrganizationId, commitOrganizationScopeValue, loadOrganizationOnDemand]);\n\n /\n Get the current active organization\n /\n const getCurrentOrganization = useCallback((): OrganizationContext \| null => {\n if (!currentOrganizationId) {\n return null;\n }\n return organizations.find(o => o._id === currentOrganizationId) \|\| null;\n }, [currentOrganizationId, organizations]);\n\n /\n Get privacy preferences\n /\n const getPrivacy = useCallback((): UserPrivacy \| null => {\n return privacy;\n }, [privacy]);\n\n // Depend on the builder alone: the whole AppScope value changes with every custom scope value, and through\n // this callback it would re-render every `useUserOrgs` consumer.\n const buildScopeContextualParameters = appScope.buildContextualParameters;\n const recordConsentDecision = useCallback(async (grantedPurposes: readonly ConsentPurpose[]): Promise<UserPrivacy> => {\n const operation = registry.resourceConfigurations[CoreResourceType.USER_SELF_PREFERENCES]?.operations.find(\n (candidate) => candidate.operationIdentifier === CoreResourceOperation.UPDATE\n && candidate.isOperationDefault === true\n && candidate.isBulkOperation !== true\n && (\n candidate.variantType === ResourceOperationVariantType.API_CALL\n ),\n );\n if (!operation) {\n throw new Error('Cannot record a consent decision: this application mounts no user self-preferences UPDATE operation');\n }\n\n const updated = await doOperation<UserPreferences>(\n ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(operation),\n {\n // This provider sits ABOVE `ScopedResourceRegistryProvider`, so the `doOperation` it holds injects\n // no scope: the user id the self-preferences route is addressed by has to be supplied here. With an\n // empty set the client could not build the URL and every decision failed before a request left\n // (`frontend_resource_no_endpoint_available`, #977 — found by driving the prompt in a browser).\n contextualParameters: buildScopeContextualParameters(),\n requestData: {\n // The client instant is only a CLAIM that this write is a decision; the server replaces it.\n privacy: { consentedPurposes: normalizeConsentPurposes(grantedPurposes), consentDecidedAt: new Date() },\n },\n },\n );\n const storedPrivacy = updated?.privacy;\n if (!storedPrivacy) {\n throw new Error('Consent decision was written but the response carried no privacy block');\n }\n\n setPrivacy(storedPrivacy);\n // Updating the user's preferences record re-emits USER_PREFERENCES_CHANGED through the effect\n // above, which is how the analytics provider learns the new set without a second channel.\n setUser((previous) => previous\n ? { ...previous, userSelfPreferences: { ...(previous.userSelfPreferences ?? {}), privacy: storedPrivacy } as UserContext['userSelfPreferences'] }\n : previous);\n // While a required purpose was missing the backend refused this person's organization reads, so\n // session restore may have loaded none (#534 re-review N1). Re-load them now that the decision is\n // stored; a failure leaves the decision recorded and is retried on the next restore.\n if (organizations.length === 0) {\n await refreshOrganizations().catch((error: unknown) => {\n logger.warn('Organizations could not be re-loaded after a consent decision', { error });\n });\n }\n return storedPrivacy;\n }, [buildScopeContextualParameters, doOperation, registry, organizations.length, refreshOrganizations]);\n\n /\n Logout wrapper that also clears user/org data\n */\n const logout = useCallback((): void => {\n logDebug('Logging out user', { userId: user?._id, organizationId: currentOrganizationId });\n\n // Announced first, while the person's consent still holds — see the block above (#1977).\n announceDeparture(SessionEndReason.SIGNED_OUT);\n\n // Clear user/org data first\n setUser(null);\n setOrganizations([]);\n commitOrganizationScopeValue(null);\n setPermissions(null);\n setPrivacy(null);\n emitPreferencesChanged(null);\n\n // Reset initialization flag\n hasInitializedRef.current = false;\n previousTokenRef.current = null;\n\n // Call auth logout (clears tokens, disconnects WebSocket)\n authLogout();\n }, [user?._id, currentOrganizationId, authLogout, announceDeparture, commitOrganizationScopeValue, emitPreferencesChanged]);\n\n // Auto-load user/org data when token becomes available\n useEffect(() => {\n const accessToken = auth.accessToken;\n\n // Skip if no token or token hasn't changed\n if (!accessToken \|\| accessToken === previousTokenRef.current) {\n return;\n }\n\n // Skip if session is already restored with this token\n if (auth.sessionRestored && user) {\n previousTokenRef.current = accessToken;\n return;\n }\n\n // Skip if already initializing\n if (hasInitializedRef.current && auth.isRestoringSession) {\n return;\n }\n\n logDebug('Token changed, initiating session restoration', {\n hasToken: !!accessToken,\n previousToken: !!previousTokenRef.current\n });\n\n previousTokenRef.current = accessToken;\n hasInitializedRef.current = true;\n\n // Restore session (will fetch user/org data)\n restoreSession().catch((error) => {\n logger.error('Session restoration failed', { error });\n });\n }, [auth.accessToken, auth.sessionRestored, auth.isRestoringSession, user, restoreSession]);\n\n // Clear data when token is removed (logged out)\n useEffect(() => {\n if (!auth.accessToken && previousTokenRef.current) {\n logDebug('Token removed, clearing user/org data');\n // Announced before `privacy: null`, with the reason the auth session recorded (#1977).\n announceDeparture(getSessionEndReason());\n setUser(null);\n setOrganizations([]);\n commitOrganizationScopeValue(null);\n setPermissions(null);\n setPrivacy(null);\n emitPreferencesChanged(null);\n previousTokenRef.current = null;\n hasInitializedRef.current = false;\n }\n }, [auth.accessToken, announceDeparture, commitOrganizationScopeValue, emitPreferencesChanged, getSessionEndReason]);\n\n const value = useMemo<UserOrgsContextType>(() => ({\n // Re-exported from AuthSession for backward compatibility\n auth,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout,\n restoreSession,\n\n // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n initiateOAuth2Login,\n handleAuthCodeExchange,\n\n // User data\n user,\n\n // Organization data\n organizations,\n currentOrganizationId,\n permissions,\n primaryScopeInitiatorIds,\n\n // Privacy (only preference managed here)\n privacy,\n\n // Organization management\n setCurrentOrganization,\n followRouteOrganization,\n getCurrentOrganization,\n refreshOrganizations,\n\n // Privacy getter\n getPrivacy,\n recordConsentDecision,\n }), [\n auth,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout,\n restoreSession,\n initiateOAuth2Login,\n handleAuthCodeExchange,\n user,\n organizations,\n currentOrganizationId,\n permissions,\n primaryScopeInitiatorIds,\n privacy,\n setCurrentOrganization,\n followRouteOrganization,\n getCurrentOrganization,\n refreshOrganizations,\n getPrivacy,\n recordConsentDecision,\n ]);\n\n return <UserOrgsContext.Provider value={value}>{children}</UserOrgsContext.Provider>;\n};\n\n// useUserOrgs hook is now in separate file: ./useUserOrgs.ts\n// This separation is required for React Fast Refresh compatibility\n"]}

package/dist/esm/core/security/auth-redirect.frontend.utils.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+/** The parameter's one name, shared with the links the backend builds into the application (an invitation email). */
 export declare const AUTH_REDIRECT_QUERY_PARAM = "redirect";
 /**
  * Is this a redirect target the app may navigate to after authentication?

package/dist/esm/core/security/auth-redirect.frontend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-redirect.frontend.utils.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,yBAAyB,~~aAAa~~,CAAC;~~AAEpD~~;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,IAAI,MAAM,CAE5F;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAET;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACxC,MAAM,CAYR;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,MAA8B,GAC3C,MAAM,CAER"}
1	+ {"version":3,"file":"auth-redirect.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAIA,qHAAqH;AACrH,eAAO,MAAM,yBAAyB,aAA+C,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,IAAI,MAAM,CAE5F;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAET;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACxC,MAAM,CAYR;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,MAA8B,GAC3C,MAAM,CAER"}

package/dist/esm/core/security/auth-redirect.frontend.utils.js CHANGED Viewed

@@ -1,6 +1,7 @@
-import { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';
+import { APPLICATION_ENTRY_POINT_REDIRECT_QUERY_PARAM, isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';
 import { CommonRoutePaths } from '../../core/runtime/routes.frontend.definitions.js';
-export const AUTH_REDIRECT_QUERY_PARAM = 'redirect';
+/** The parameter's one name, shared with the links the backend builds into the application (an invitation email). */
+export const AUTH_REDIRECT_QUERY_PARAM = APPLICATION_ENTRY_POINT_REDIRECT_QUERY_PARAM;
 /**
  * Is this a redirect target the app may navigate to after authentication?
  *

package/dist/esm/core/security/auth-redirect.frontend.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-redirect.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;~~AAEhF~~,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAEhG,MAAM,CAAC,MAAM,yBAAyB,GAAG,~~UAAU~~,CAAC;~~AAEpD~~;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAiC;IACxE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAIvC;IACC,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IAChD,YAAY,CAAC,GAAG,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC1C,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAEnE,OAAO,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,eAAuB,gBAAgB,CAAC,IAAI;IAE5C,OAAO,6BAA6B,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC;AAC/D,CAAC","sourcesContent":["import { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\n\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\n\nexport const AUTH_REDIRECT_QUERY_PARAM = ~~'redirect'~~;\n\n/*\n Is this a redirect target the app may navigate to after authentication?\n \n ## Why this delegates instead of testing prefixes\n \n The previous implementation was `target.startsWith('/') && !target.startsWith('//')`, and it is\n * worth writing down why that is not a weaker version of the check but a broken one: it tests the\n * bytes a human reads, while the browser navigates to what its URL PARSER produces, and the two\n * disagree on a whole family of inputs. SEVEN shapes passed it and resolved to `https://evil.com/` —\n * `/\\evil.com`, `/\\\\evil.com`, `/\\/evil.com`, and the tab / LF / CR variants that the parser strips\n * before parsing. The measurement and the two parser rules behind it are documented once, at\n * {@link isSameOriginRedirectPath}.\n \n The exploit is post-authentication, which is what makes it worth more than an ordinary open\n * redirect: the user has just proved who they are to a site they trust, and the app hands them to the\n * attacker's origin carrying that established trust.\n \n ## Why the predicate is imported rather than written here\n \n Three other surfaces answer the same question — the one-off-session receiver, the docs-site auth\n * exchange page, and the issuer/receiver schemas in `saas-models` — and on 2026-08-15 all four\n * carried the same hole, because each was a separately hand-written deny-list that \"mirrored\" the\n * others. One importable predicate is what stops the fifth copy from being written.\n */\nexport function isSafeAuthRedirectTarget(target: string \| null \| undefined): target is string {\n return isSameOriginRedirectPath(target);\n}\n\nexport function buildAuthRedirectTarget(params: {\n pathname: string;\n search?: string;\n hash?: string;\n}): string {\n return `${params.pathname}${params.search ?? ''}${params.hash ?? ''}`;\n}\n\nexport function appendAuthRedirectToPath(\n basePath: string,\n redirectTarget: string \| null \| undefined,\n): string {\n if (!isSafeAuthRedirectTarget(redirectTarget)) {\n return basePath;\n }\n\n const [pathAndQuery, hash = ''] = basePath.split('#');\n const [pathname, query = ''] = pathAndQuery.split('?');\n const searchParams = new URLSearchParams(query);\n searchParams.set(AUTH_REDIRECT_QUERY_PARAM, redirectTarget);\n\n const nextQuery = searchParams.toString();\n return `${pathname}${nextQuery ? `?${nextQuery}` : ''}${hash ? `#${hash}` : ''}`;\n}\n\nexport function extractAuthRedirectFromSearch(search: string): string \| undefined {\n const searchParams = new URLSearchParams(search);\n const redirectTarget = searchParams.get(AUTH_REDIRECT_QUERY_PARAM);\n\n return isSafeAuthRedirectTarget(redirectTarget) ? redirectTarget : undefined;\n}\n\nexport function resolvePostAuthRedirect(\n search: string,\n fallbackPath: string = CommonRoutePaths.home,\n): string {\n return extractAuthRedirectFromSearch(search) ?? fallbackPath;\n}\n"]}
1	+ {"version":3,"file":"auth-redirect.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4CAA4C,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAE9H,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAEhG,qHAAqH;AACrH,MAAM,CAAC,MAAM,yBAAyB,GAAG,4CAA4C,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAiC;IACxE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAIvC;IACC,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IAChD,YAAY,CAAC,GAAG,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC1C,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAEnE,OAAO,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,eAAuB,gBAAgB,CAAC,IAAI;IAE5C,OAAO,6BAA6B,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC;AAC/D,CAAC","sourcesContent":["import { APPLICATION_ENTRY_POINT_REDIRECT_QUERY_PARAM, isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\n\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\n\n/** The parameter's one name, shared with the links the backend builds into the application (an invitation email). /\nexport const AUTH_REDIRECT_QUERY_PARAM = APPLICATION_ENTRY_POINT_REDIRECT_QUERY_PARAM;\n\n/\n Is this a redirect target the app may navigate to after authentication?\n \n ## Why this delegates instead of testing prefixes\n \n The previous implementation was `target.startsWith('/') && !target.startsWith('//')`, and it is\n * worth writing down why that is not a weaker version of the check but a broken one: it tests the\n * bytes a human reads, while the browser navigates to what its URL PARSER produces, and the two\n * disagree on a whole family of inputs. SEVEN shapes passed it and resolved to `https://evil.com/` —\n * `/\\evil.com`, `/\\\\evil.com`, `/\\/evil.com`, and the tab / LF / CR variants that the parser strips\n * before parsing. The measurement and the two parser rules behind it are documented once, at\n * {@link isSameOriginRedirectPath}.\n \n The exploit is post-authentication, which is what makes it worth more than an ordinary open\n * redirect: the user has just proved who they are to a site they trust, and the app hands them to the\n * attacker's origin carrying that established trust.\n \n ## Why the predicate is imported rather than written here\n \n Three other surfaces answer the same question — the one-off-session receiver, the docs-site auth\n * exchange page, and the issuer/receiver schemas in `saas-models` — and on 2026-08-15 all four\n * carried the same hole, because each was a separately hand-written deny-list that \"mirrored\" the\n * others. One importable predicate is what stops the fifth copy from being written.\n */\nexport function isSafeAuthRedirectTarget(target: string \| null \| undefined): target is string {\n return isSameOriginRedirectPath(target);\n}\n\nexport function buildAuthRedirectTarget(params: {\n pathname: string;\n search?: string;\n hash?: string;\n}): string {\n return `${params.pathname}${params.search ?? ''}${params.hash ?? ''}`;\n}\n\nexport function appendAuthRedirectToPath(\n basePath: string,\n redirectTarget: string \| null \| undefined,\n): string {\n if (!isSafeAuthRedirectTarget(redirectTarget)) {\n return basePath;\n }\n\n const [pathAndQuery, hash = ''] = basePath.split('#');\n const [pathname, query = ''] = pathAndQuery.split('?');\n const searchParams = new URLSearchParams(query);\n searchParams.set(AUTH_REDIRECT_QUERY_PARAM, redirectTarget);\n\n const nextQuery = searchParams.toString();\n return `${pathname}${nextQuery ? `?${nextQuery}` : ''}${hash ? `#${hash}` : ''}`;\n}\n\nexport function extractAuthRedirectFromSearch(search: string): string \| undefined {\n const searchParams = new URLSearchParams(search);\n const redirectTarget = searchParams.get(AUTH_REDIRECT_QUERY_PARAM);\n\n return isSafeAuthRedirectTarget(redirectTarget) ? redirectTarget : undefined;\n}\n\nexport function resolvePostAuthRedirect(\n search: string,\n fallbackPath: string = CommonRoutePaths.home,\n): string {\n return extractAuthRedirectFromSearch(search) ?? fallbackPath;\n}\n"]}

package/dist/esm/core/security/auth-session.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-session.utils.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/security/auth-session.utils.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,eAAe,EAAE,UAAU,EAAE,CAAC;IAC9B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAkBD;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO;IAEP;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAuCjD;;;OAGG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAiBhD;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAChC,WAAW,EAAE,OAAO,EACpB,mBAAmB,EAAE,UAAU,EAAE,EACjC,2BAA2B,EAAE,UAAU,EAAE,EACzC,oBAAoB,EAAE,UAAU,EAAE,GACjC,yBAAyB;CA0D7B"}
1	+ {"version":3,"file":"auth-session.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/auth-session.utils.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,eAAe,EAAE,UAAU,EAAE,CAAC;IAC9B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAkBD;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO;IAEP;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAuCjD;;;OAGG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAiBhD;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAChC,WAAW,EAAE,OAAO,EACpB,mBAAmB,EAAE,UAAU,EAAE,EACjC,2BAA2B,EAAE,UAAU,EAAE,EACzC,oBAAoB,EAAE,UAAU,EAAE,GACjC,yBAAyB;CA0D7B"}

package/dist/esm/core/security/consent-gate.frontend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"consent-gate.frontend.utils.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/security/consent-gate.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,EAGd,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,oBAAY,iBAAiB;IAC3B,0GAA0G;IAC1G,cAAc,kBAAkB;IAChC;;;;OAIG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,MAAM,WAAW;IACjB,mGAAmG;IACnG,SAAS,cAAc;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IACjE,2EAA2E;IAC3E,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4FAA4F;IAC5F,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,iFAAiF;IACjF,OAAO,EAAE;QAAE,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAC;CACzG;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,8DAA8D;IAC9D,gBAAgB,EAAE,cAAc,EAAE,CAAC;IACnC,qGAAqG;IACrG,uBAAuB,EAAE,cAAc,EAAE,CAAC;IAC1C;;;;OAIG;IACH,gBAAgB,EAAE,cAAc,EAAE,CAAC;IACnC,+CAA+C;IAC/C,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAyChF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC,cAAc,EAAE,CAIlB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,GAAG,iBAAiB,CAAC,EACrE,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC,cAAc,EAAE,CAGlB"}
1	+ {"version":3,"file":"consent-gate.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/consent-gate.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,EAGd,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,oBAAY,iBAAiB;IAC3B,0GAA0G;IAC1G,cAAc,kBAAkB;IAChC;;;;OAIG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,MAAM,WAAW;IACjB,mGAAmG;IACnG,SAAS,cAAc;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IACjE,2EAA2E;IAC3E,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4FAA4F;IAC5F,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,iFAAiF;IACjF,OAAO,EAAE;QAAE,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAC;CACzG;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,8DAA8D;IAC9D,gBAAgB,EAAE,cAAc,EAAE,CAAC;IACnC,qGAAqG;IACrG,uBAAuB,EAAE,cAAc,EAAE,CAAC;IAC1C;;;;OAIG;IACH,gBAAgB,EAAE,cAAc,EAAE,CAAC;IACnC,+CAA+C;IAC/C,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAyChF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC,cAAc,EAAE,CAIlB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,GAAG,iBAAiB,CAAC,EACrE,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC,cAAc,EAAE,CAGlB"}

package/dist/esm/core/security/cross-frontend-handoff.frontend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cross-frontend-handoff.frontend.service.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EACL,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sEAAsE,CAAC;AAE3G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mCAAmC,GAC3C,6BAA6B,GAC7B,iBAAiB,GACjB,SAAS,GACT,oBAAoB,CAAC;AAEzB;;;;;;;;GAQG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAE,mCAAmC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEvB,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;CAMlG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,4BAA4B,CAAC,CAoBvC;AAiED,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,0BAA0B,CAAC;IACnC,IAAI,EAAE,4BAA4B,GAAG,IAAI,CAAC;IAC1C,KAAK,EAAE,+BAA+B,GAAG,IAAI,CAAC;IAC9C,cAAc,EAAE,CACd,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,KACrB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,IAAI,6BAA6B,CAyDvE"}
1	+ {"version":3,"file":"cross-frontend-handoff.frontend.service.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EACL,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sEAAsE,CAAC;AAE3G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mCAAmC,GAC3C,6BAA6B,GAC7B,iBAAiB,GACjB,SAAS,GACT,oBAAoB,CAAC;AAEzB;;;;;;;;GAQG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAE,mCAAmC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEvB,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;CAMlG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,4BAA4B,CAAC,CAoBvC;AAiED,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,0BAA0B,CAAC;IACnC,IAAI,EAAE,4BAA4B,GAAG,IAAI,CAAC;IAC1C,KAAK,EAAE,+BAA+B,GAAG,IAAI,CAAC;IAC9C,cAAc,EAAE,CACd,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,KACrB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,IAAI,6BAA6B,CAyDvE"}

package/dist/esm/core/security/effective-permissions.frontend.utils.d.ts ADDED Viewed

@@ -0,0 +1,43 @@
+/**
+ * The membership roles the shell decides with, taken from the backend's access profile when it has one (#2381).
+ */
+import { type UserSelfAccessProfile } from '@wildo-ai/saas-models';
+import type { EffectivePermissions } from './security.frontend.schemas';
+/**
+ * `appLevel` and `organizations` as the BACKEND confers them: the application entry's roles, and per organization the
+ * roles of its ORGANIZATION-WIDE entries (`selectOrganizationWideRoles` over the entries acting in that organization —
+ * the backend's own two selections).
+ *
+ * Why not the membership rows the user context carries: a row is not what the backend authorizes with. A relationship
+ * membership's `roles` mirror its relationship "for display", so a unit-scoped representative's row reads as an
+ * organization-wide relationship role the backend never confers (its entries are unit-scoped); a delegated capability
+ * role on an ordinary row is dropped by the backend; a membership in a tenant that no longer confers authority confers
+ * nothing. Deciding on the rows, the shell offered entries the backend then refused.
+ *
+ * Unit-scoped entries are left out on purpose: they reach only resources that narrow by unit, which
+ * `viewerMayPerformOperation` decides from the profile itself.
+ */
+export declare function membershipRolesFromAccessProfile(profile: UserSelfAccessProfile): Pick<EffectivePermissions, 'appLevel' | 'organizations'>;
+/**
+ * Whether the backend's access profile confers anything in `organizationId`: an organization-wide or unit-scoped entry
+ * from an ACTIVE membership in a tenant that still confers authority, or a relationship entry that passed the live
+ * filter (#1597). That is the backend's own answer to "may this person act in this organization", built from every
+ * membership (`ExecutionContextCreatorBackendService.buildAccessProfileRoleEntries` lists them unpaginated).
+ *
+ * It is what admits an organization the user context does not carry (#2275). The context's `organizationMembers` is a
+ * projection capped at `DEFAULT_RELATIONSHIP_CONTEXT_POLICY.limit` (20, newest first), so for a person in more
+ * organizations the rows simply stop; the profile does not. An APPLICATION entry is never a conferral here, so a
+ * platform operator's crossing into a tenant is not mistaken for a membership.
+ */
+export declare function accessProfileConfersOrganization(profile: UserSelfAccessProfile | null | undefined, organizationId: string | null | undefined): boolean;
+/**
+ * The organizations the organization switcher can FIND for this person (#2452): every organization the access profile
+ * carries an organization-WIDE entry in, in profile order, without duplicates.
+ *
+ * Organization-wide, not every entry {@link accessProfileConfersOrganization} counts, because this is the population
+ * `GET /organizations/search/mine` returns: the backend confines that read to the caller's organization-wide entries.
+ * The number the switcher states ("N more") and the rows its search finds are then the same set, by construction. A
+ * unit-only standing (a unit-scoped representative) is still followed by route, but is not offered here.
+ */
+export declare function accessProfileSwitchableOrganizationIds(profile: UserSelfAccessProfile | null | undefined): string[];
+//# sourceMappingURL=effective-permissions.frontend.utils.d.ts.map

package/dist/esm/core/security/effective-permissions.frontend.utils.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"effective-permissions.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/effective-permissions.frontend.utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAKL,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,qBAAqB,GAC7B,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,eAAe,CAAC,CAc1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,EACjD,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACxC,OAAO,CAKT;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CASlH"}

package/dist/esm/core/security/effective-permissions.frontend.utils.js ADDED Viewed

@@ -0,0 +1,73 @@
+/**
+ * The membership roles the shell decides with, taken from the backend's access profile when it has one (#2381).
+ */
+import { ResourcePrimaryScope, isOrganizationWideRoleInfo, selectOrganizationWideRoles, selectRoleInfosActingInOrganization, } from '@wildo-ai/saas-models';
+/**
+ * `appLevel` and `organizations` as the BACKEND confers them: the application entry's roles, and per organization the
+ * roles of its ORGANIZATION-WIDE entries (`selectOrganizationWideRoles` over the entries acting in that organization —
+ * the backend's own two selections).
+ *
+ * Why not the membership rows the user context carries: a row is not what the backend authorizes with. A relationship
+ * membership's `roles` mirror its relationship "for display", so a unit-scoped representative's row reads as an
+ * organization-wide relationship role the backend never confers (its entries are unit-scoped); a delegated capability
+ * role on an ordinary row is dropped by the backend; a membership in a tenant that no longer confers authority confers
+ * nothing. Deciding on the rows, the shell offered entries the backend then refused.
+ *
+ * Unit-scoped entries are left out on purpose: they reach only resources that narrow by unit, which
+ * `viewerMayPerformOperation` decides from the profile itself.
+ */
+export function membershipRolesFromAccessProfile(profile) {
+    const appLevel = [...new Set(profile.roleEntries
+            .filter((entry) => entry.relatedPrimaryScope === ResourcePrimaryScope.APPLICATION)
+            .flatMap((entry) => entry.roles))];
+    const organizationIds = new Set(profile.roleEntries
+        .filter((entry) => entry.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS && entry.relatedResourceId)
+        .map((entry) => String(entry.relatedResourceId)));
+    const organizations = {};
+    for (const organizationId of organizationIds) {
+        const actingInOrganization = selectRoleInfosActingInOrganization(profile.roleEntries, organizationId)
+            .filter((entry) => entry.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS);
+        organizations[organizationId] = [...new Set(selectOrganizationWideRoles(actingInOrganization))];
+    }
+    return { appLevel, organizations };
+}
+/**
+ * Whether the backend's access profile confers anything in `organizationId`: an organization-wide or unit-scoped entry
+ * from an ACTIVE membership in a tenant that still confers authority, or a relationship entry that passed the live
+ * filter (#1597). That is the backend's own answer to "may this person act in this organization", built from every
+ * membership (`ExecutionContextCreatorBackendService.buildAccessProfileRoleEntries` lists them unpaginated).
+ *
+ * It is what admits an organization the user context does not carry (#2275). The context's `organizationMembers` is a
+ * projection capped at `DEFAULT_RELATIONSHIP_CONTEXT_POLICY.limit` (20, newest first), so for a person in more
+ * organizations the rows simply stop; the profile does not. An APPLICATION entry is never a conferral here, so a
+ * platform operator's crossing into a tenant is not mistaken for a membership.
+ */
+export function accessProfileConfersOrganization(profile, organizationId) {
+    if (!profile || !organizationId)
+        return false;
+    return profile.roleEntries.some((entry) => entry.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS
+        && String(entry.relatedResourceId ?? '') === organizationId);
+}
+/**
+ * The organizations the organization switcher can FIND for this person (#2452): every organization the access profile
+ * carries an organization-WIDE entry in, in profile order, without duplicates.
+ *
+ * Organization-wide, not every entry {@link accessProfileConfersOrganization} counts, because this is the population
+ * `GET /organizations/search/mine` returns: the backend confines that read to the caller's organization-wide entries.
+ * The number the switcher states ("N more") and the rows its search finds are then the same set, by construction. A
+ * unit-only standing (a unit-scoped representative) is still followed by route, but is not offered here.
+ */
+export function accessProfileSwitchableOrganizationIds(profile) {
+    if (!profile)
+        return [];
+    const ids = new Set();
+    for (const entry of profile.roleEntries) {
+        if (entry.relatedPrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS || !isOrganizationWideRoleInfo(entry))
+            continue;
+        const organizationId = String(entry.relatedResourceId ?? '');
+        if (organizationId)
+            ids.add(organizationId);
+    }
+    return [...ids];
+}
+//# sourceMappingURL=effective-permissions.frontend.utils.js.map

package/dist/esm/core/security/effective-permissions.frontend.utils.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"effective-permissions.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/effective-permissions.frontend.utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,mCAAmC,GAEpC,MAAM,uBAAuB,CAAC;AAG/B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAA8B;IAE9B,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW;aAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,WAAW,CAAC;aACjF,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW;SAChD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa,IAAI,KAAK,CAAC,iBAAiB,CAAC;SAC9G,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,aAAa,GAA6B,EAAE,CAAC;IACnD,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;QAC7C,MAAM,oBAAoB,GAAG,mCAAmC,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC;aAClG,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACvF,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAiD,EACjD,cAAyC;IAEzC,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,KAAK,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa;WAC7D,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,KAAK,cAAc,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sCAAsC,CAAC,OAAiD;IACtG,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC;YAAE,SAAS;QACrH,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,cAAc;YAAE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The membership roles the shell decides with, taken from the backend's access profile when it has one (#2381).\n */\nimport {\n ResourcePrimaryScope,\n isOrganizationWideRoleInfo,\n selectOrganizationWideRoles,\n selectRoleInfosActingInOrganization,\n type UserSelfAccessProfile,\n} from '@wildo-ai/saas-models';\nimport type { EffectivePermissions } from './security.frontend.schemas';\n\n/**\n * `appLevel` and `organizations` as the BACKEND confers them: the application entry's roles, and per organization the\n * roles of its ORGANIZATION-WIDE entries (`selectOrganizationWideRoles` over the entries acting in that organization —\n * the backend's own two selections).\n *\n * Why not the membership rows the user context carries: a row is not what the backend authorizes with. A relationship\n * membership's `roles` mirror its relationship \"for display\", so a unit-scoped representative's row reads as an\n * organization-wide relationship role the backend never confers (its entries are unit-scoped); a delegated capability\n * role on an ordinary row is dropped by the backend; a membership in a tenant that no longer confers authority confers\n * nothing. Deciding on the rows, the shell offered entries the backend then refused.\n *\n * Unit-scoped entries are left out on purpose: they reach only resources that narrow by unit, which\n * `viewerMayPerformOperation` decides from the profile itself.\n */\nexport function membershipRolesFromAccessProfile(\n profile: UserSelfAccessProfile,\n): Pick<EffectivePermissions, 'appLevel' | 'organizations'> {\n const appLevel = [...new Set(profile.roleEntries\n .filter((entry) => entry.relatedPrimaryScope === ResourcePrimaryScope.APPLICATION)\n .flatMap((entry) => entry.roles))];\n const organizationIds = new Set(profile.roleEntries\n .filter((entry) => entry.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS && entry.relatedResourceId)\n .map((entry) => String(entry.relatedResourceId)));\n const organizations: Record<string, string[]> = {};\n for (const organizationId of organizationIds) {\n const actingInOrganization = selectRoleInfosActingInOrganization(profile.roleEntries, organizationId)\n .filter((entry) => entry.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS);\n organizations[organizationId] = [...new Set(selectOrganizationWideRoles(actingInOrganization))];\n }\n return { appLevel, organizations };\n}\n\n/**\n * Whether the backend's access profile confers anything in `organizationId`: an organization-wide or unit-scoped entry\n * from an ACTIVE membership in a tenant that still confers authority, or a relationship entry that passed the live\n * filter (#1597). That is the backend's own answer to \"may this person act in this organization\", built from every\n * membership (`ExecutionContextCreatorBackendService.buildAccessProfileRoleEntries` lists them unpaginated).\n *\n * It is what admits an organization the user context does not carry (#2275). The context's `organizationMembers` is a\n * projection capped at `DEFAULT_RELATIONSHIP_CONTEXT_POLICY.limit` (20, newest first), so for a person in more\n * organizations the rows simply stop; the profile does not. An APPLICATION entry is never a conferral here, so a\n * platform operator's crossing into a tenant is not mistaken for a membership.\n */\nexport function accessProfileConfersOrganization(\n profile: UserSelfAccessProfile | null | undefined,\n organizationId: string | null | undefined,\n): boolean {\n if (!profile || !organizationId) return false;\n return profile.roleEntries.some((entry) =>\n entry.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS\n && String(entry.relatedResourceId ?? '') === organizationId);\n}\n\n/**\n * The organizations the organization switcher can FIND for this person (#2452): every organization the access profile\n * carries an organization-WIDE entry in, in profile order, without duplicates.\n *\n * Organization-wide, not every entry {@link accessProfileConfersOrganization} counts, because this is the population\n * `GET /organizations/search/mine` returns: the backend confines that read to the caller's organization-wide entries.\n * The number the switcher states (\"N more\") and the rows its search finds are then the same set, by construction. A\n * unit-only standing (a unit-scoped representative) is still followed by route, but is not offered here.\n */\nexport function accessProfileSwitchableOrganizationIds(profile: UserSelfAccessProfile | null | undefined): string[] {\n if (!profile) return [];\n const ids = new Set<string>();\n for (const entry of profile.roleEntries) {\n if (entry.relatedPrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS || !isOrganizationWideRoleInfo(entry)) continue;\n const organizationId = String(entry.relatedResourceId ?? '');\n if (organizationId) ids.add(organizationId);\n }\n return [...ids];\n}\n"]}

package/dist/esm/core/security/federated-reauthentication.frontend.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"federated-reauthentication.frontend.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/security/federated-reauthentication.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,4HAA4H;AAC5H,eAAO,MAAM,iCAAiC,2BAA2B,CAAC;AAC1E,eAAO,MAAM,sCAAsC,oCAAoC,CAAC;AAExF,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,OAAO,sCAAsC,CAAC;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iGAAiG;AACjG,oBAAY,sCAAsC;IAChD,8CAA8C;IAC9C,aAAa,kBAAkB;IAC/B,qFAAqF;IACrF,SAAS,cAAc;IACvB,+HAA+H;IAC/H,SAAS,cAAc;IACvB,wEAAwE;IACxE,MAAM,WAAW;CAClB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;aAC7B,MAAM,EAAE,sCAAsC;gBAA9C,MAAM,EAAE,sCAAsC;CAI3E;AAOD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAE1D;AAED,8EAA8E;AAC9E,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,IAAI,CAAC,+BAA+B,EAAE,MAAM,CAAC,GAAG,IAAI,CAI3G;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,GAAE,MAA2C,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B3I;AAED;;;;;GAKG;AACH,wBAAsB,oCAAoC,CACxD,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAclC"}
1	+ {"version":3,"file":"federated-reauthentication.frontend.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/federated-reauthentication.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,4HAA4H;AAC5H,eAAO,MAAM,iCAAiC,2BAA2B,CAAC;AAC1E,eAAO,MAAM,sCAAsC,oCAAoC,CAAC;AAExF,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,OAAO,sCAAsC,CAAC;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iGAAiG;AACjG,oBAAY,sCAAsC;IAChD,8CAA8C;IAC9C,aAAa,kBAAkB;IAC/B,qFAAqF;IACrF,SAAS,cAAc;IACvB,+HAA+H;IAC/H,SAAS,cAAc;IACvB,wEAAwE;IACxE,MAAM,WAAW;CAClB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;aAC7B,MAAM,EAAE,sCAAsC;gBAA9C,MAAM,EAAE,sCAAsC;CAI3E;AAOD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAE1D;AAED,8EAA8E;AAC9E,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,IAAI,CAAC,+BAA+B,EAAE,MAAM,CAAC,GAAG,IAAI,CAI3G;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,GAAE,MAA2C,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B3I;AAED;;;;;GAKG;AACH,wBAAsB,oCAAoC,CACxD,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAclC"}