@wildo-ai/saas-frontend-lib 1.1.2 → 1.1.4

package/dist/esm/core/security/UserOrgsContext.js

@@ -54,12 +54,40 @@ export const UserOrgsProvider = ({ children }) => {
     const [organizations, setOrganizations] = useState([]);
     const [permissions, setPermissions] = useState(null);
     const [privacy, setPrivacy] = useState(null);
-    const emitPreferencesChanged = useCallback((preferences, organizationLanguagePreferences) => {
+    /**
+     * The TENANT's half of the payload, derived from its preferences record rather than passed
+     * alongside it (#410).
+     *
+     * The organization contributes two things to `I18nContext` — its language policy and its regional
+     * defaults — and they are forwarded together because they come from one record. An earlier shape
+     * took the language block as its own argument, and when the regional half was added every call
+     * site would have had to remember to forward a second one: three sites, one obligation each, and
+     * a fourth site tomorrow that forwards neither. Passing the record makes forgetting impossible.
+     */
+    const organizationPreferencesPayload = (organizationPreferences) => {
+        if (organizationPreferences === undefined) {
+            return {};
+        }
+        if (organizationPreferences === null) {
+            return { organizationLanguagePreferences: null, organizationRegionalPreferences: null };
+        }
+        return {
+            organizationLanguagePreferences: organizationPreferences.languagePreferences ?? null,
+            organizationRegionalPreferences: {
+                timezone: organizationPreferences.timezone,
+                locale: organizationPreferences.locale,
+                dateFormat: organizationPreferences.dateFormat,
+                timeFormat: organizationPreferences.timeFormat,
+            },
+        };
+    };
+    const emitPreferencesChanged = useCallback((preferences, organizationPreferences) => {
         if (preferences === null) {
             emit(FrontendEvents.USER_PREFERENCES_CHANGED, {
                 languagePreferences: null,
                 organizationLanguagePreferences: null,
                 regionalPreferences: null,
+                organizationRegionalPreferences: null,
                 notificationsPreferences: null,
                 uiPreferences: null,
                 privacy: null,
@@ -68,7 +96,7 @@ export const UserOrgsProvider = ({ children }) => {
         }
         emit(FrontendEvents.USER_PREFERENCES_CHANGED, {
             ...(preferences?.languagePreferences !== undefined ? { languagePreferences: preferences.languagePreferences } : {}),
-            ...(organizationLanguagePreferences !== undefined ? { organizationLanguagePreferences } : {}),
+            ...organizationPreferencesPayload(organizationPreferences),
             ...(preferences?.regional !== undefined ? { regionalPreferences: preferences.regional } : {}),
             ...(preferences?.notifications !== undefined ? { notificationsPreferences: preferences.notifications } : {}),
             ...(preferences?.ui !== undefined ? { uiPreferences: preferences.ui } : {}),
@@ -92,18 +120,18 @@ export const UserOrgsProvider = ({ children }) => {
      * Extract and store user preferences from context
      * Stores preferences in state for other contexts to read and apply
      */
-    const storePreferences = useCallback((preferences, organizationLanguagePreferences) => {
+    const storePreferences = useCallback((preferences, organizationPreferences) => {
         // Store privacy preferences in state
         if (preferences.privacy) {
             setPrivacy(preferences.privacy);
         }
-        const currentOrganizationLanguagePreferences = organizationLanguagePreferences !== undefined
-            ? organizationLanguagePreferences
+        const currentOrganizationPreferences = organizationPreferences !== undefined
+            ? organizationPreferences
             : currentOrganizationId
-                ? organizations.find((organization) => organization._id === currentOrganizationId)?.preferences?.languagePreferences
+                ? organizations.find((organization) => organization._id === currentOrganizationId)?.preferences
                 : undefined;
         // Emit preference change event to notify parent contexts
-        emitPreferencesChanged(preferences, currentOrganizationLanguagePreferences);
+        emitPreferencesChanged(preferences, currentOrganizationPreferences);
     }, [currentOrganizationId, emitPreferencesChanged, organizations]);
     /**
      * Compute effective permissions from user's app roles and organization roles
@@ -158,10 +186,66 @@ export const UserOrgsProvider = ({ children }) => {
                 return { organizationsList, selectedOrgId: null };
             }
             const organizationsOperationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(orgsReadOp);
+            /**
+             * The tenant's preference record is fetched SEPARATELY, and that is a decision rather than an
+             * omission (#563).
+             *
+             * `OrganizationContextSchema` declares `preferences`, and `doOperation<OrganizationContext>`
+             * is a CAST — nothing validates the response against it — so the field read as available
+             * while no producer existed: the ORGANIZATIONS **default** READ returns a plain
+             * `Organization`, and the organisation's regional block therefore never reached
+             * `I18nContext`. Every date and number in every generated application formatted at the
+             * framework floor as a result.
+             *
+             * The rejected alternative was to switch this call to the ORGANIZATIONS **context** variant,
+             * which does populate the child. Measured against the running stack on 2026-09-10, that
+             * response carries every context-enabled child of an organisation — `auditLogs`, `todos`,
+             * `tasks`, `knowledgeDocuments`, `organizationMembers`, … — so session restore would pull an
+             * unbounded page of tenant data per membership to obtain four regional fields. The
+             * preference record has its own default READ (`GET /organizations/{id}/organization-preference`,
+             * reachable by an ordinary `ORG_MEMBER`), which is one small request with a stable shape.
+             *
+             * Best-effort by construction: a tenant whose preferences cannot be read still yields a
+             * usable organisation, and `organizationPreferencesPayload(undefined)` then contributes
+             * nothing to the i18n event rather than clearing the member's own settings.
+             */
+            const organizationPreferencesConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES];
+            const organizationPreferencesReadOp = organizationPreferencesConfig?.operations?.find((op) => op.operationIdentifier === CoreResourceOperation.READ &&
+                op.isOperationDefault === true &&
+                op.isBulkOperation !== true &&
+                (op.variantType === ResourceOperationVariantType.API_CALL ||
+                    op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK));
+            if (!organizationPreferencesReadOp) {
+                logger.warn('ORGANIZATION_PREFERENCES READ operation not found — tenant regional defaults will not be applied');
+            }
+            const organizationPreferencesOperationPath = organizationPreferencesReadOp
+                ? ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(organizationPreferencesReadOp)
+                : null;
+            const fetchOrganizationPreferences = async (organizationId) => {
+                if (!organizationPreferencesOperationPath)
+                    return undefined;
+                try {
+                    return await doOperation(organizationPreferencesOperationPath, { contextualParameters: { organizationId } }) ?? undefined;
+                }
+                catch (error) {
+                    logger.warn('Failed to fetch organization preferences', { organizationId, error });
+                    return undefined;
+                }
+            };
             const orgPromises = memberships.map(async (membership) => {
                 try {
-                    const org = await doOperation(organizationsOperationPath, { contextualParameters: { organizationId: membership.organizationId } });
-                    return org;
+                    const [org, preferences] = await Promise.all([
+                        doOperation(organizationsOperationPath, { contextualParameters: { organizationId: membership.organizationId } }),
+                        fetchOrganizationPreferences(membership.organizationId),
+                    ]);
+                    if (!org)
+                        return null;
+                    // OMIT the key when the read failed rather than attaching `null`. The payload builder
+                    // reads the two differently: `undefined`/absent contributes nothing to the i18n event,
+                    // while `null` means "the tenant has cleared its preferences" and actively resets the
+                    // organisation half — which would silently downgrade a member to the framework floor
+                    // because one request failed.
+                    return preferences ? { ...org, preferences } : org;
                 }
                 catch (error) {
                     logger.warn('Failed to fetch organization', { organizationId: membership.organizationId, error });
@@ -248,12 +332,12 @@ export const UserOrgsProvider = ({ children }) => {
         const { organizationsList, selectedOrgId } = await loadOrganizations(userContext);
         // Store preferences after organization loading so i18n receives user and
         // active-organization language policy in the same event.
-        const preferences = userContext.userSelfPreference;
+        const preferences = userContext.userSelfPreferences;
         if (preferences) {
             const currentOrganization = selectedOrgId
                 ? organizationsList.find((organization) => organization._id === selectedOrgId)
                 : null;
-            storePreferences(preferences, currentOrganization?.preferences?.languagePreferences);
+            storePreferences(preferences, currentOrganization?.preferences);
         }
         logger.info('Session restored successfully', {
             userId: userContext._id,
@@ -419,13 +503,13 @@ export const UserOrgsProvider = ({ children }) => {
         await loadOrganizations(user);
     }, [user, loadOrganizations]);
     useEffect(() => {
-        if (!user?.userSelfPreference) {
+        if (!user?.userSelfPreferences) {
             return;
         }
         const currentOrganization = currentOrganizationId
             ? organizations.find((organization) => organization._id === currentOrganizationId)
             : null;
-        emitPreferencesChanged(user.userSelfPreference, currentOrganization?.preferences?.languagePreferences);
+        emitPreferencesChanged(user.userSelfPreferences, currentOrganization?.preferences);
     }, [currentOrganizationId, emitPreferencesChanged, organizations, user]);
     /**
      * Set the current active organization

package/dist/esm/core/security/UserOrgsContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserOrgsContext.js","sourceRoot":"","sources":["../../../../../src/core/security/UserOrgsContext.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,aAAa,EAAE,QAAQ,EAAa,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC3G,OAAO,EAGL,gBAAgB,EAChB,kCAAkC,EAClC,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EAIrB,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,6CAA6C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAIzF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAEhG,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AACxE,MAAM,QAAQ,GAAiE,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;AACrH,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AA4C1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmD,aAAa,CAAkC,SAAS,CAAC,CAAC;AAEzI,MAAM,CAAC,MAAM,gBAAgB,GAAsC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IAClF,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAE/B,+BAA+B;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,MAAM,EAAE,UAAU,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,GAAG,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,4BAA4B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC/D,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IAE7D,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,gBAAgB,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IACrD,yEAAyE;IACzE,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,oBAAoB,GAAG,MAAM,CAAuC,IAAI,CAAC,CAAC;IAEhF,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAE3D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAwB,EAAE,CAAC,CAAC;IAE9E,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAGpC,IAAI,CAAC,CAAC;IAEhB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAIjE,MAAM,sBAAsB,GAAG,WAAW,CAAC,CACzC,WAAkD,EAClD,+BAAkG,EAC5F,EAAE;QACR,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;gBAC5C,mBAAmB,EAAE,IAAI;gBACzB,+BAA+B,EAAE,IAAI;gBACrC,mBAAmB,EAAE,IAAI;gBACzB,wBAAwB,EAAE,IAAI;gBAC9B,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;YAC5C,GAAG,CAAC,WAAW,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnH,GAAG,CAAC,+BAA+B,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,WAAW,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,WAAW,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,MAAM,wBAAwB,GAAG,OAAO,CAAuC,GAAG,EAAE;QAClF,OAAO,iBAAiB,CAAC,iBAAiB,CAAC;YACzC,MAAM,EAAE,QAAQ,CAAC,aAAa;YAC9B,cAAc,EAAE,QAAQ,CAAC,qBAAqB;YAC9C,aAAa,EAAE,QAAQ,CAAC,oBAAoB;YAC5C,eAAe,EAAE,QAAQ,CAAC,sBAAsB;SACjD,CAAC,CAAC;IACL,CAAC,EAAE;QACD,QAAQ,CAAC,oBAAoB;QAC7B,QAAQ,CAAC,sBAAsB;QAC/B,QAAQ,CAAC,qBAAqB;QAC9B,QAAQ,CAAC,aAAa;KACvB,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,CACnC,WAA+B,EAC/B,+BAAkG,EAC5F,EAAE;QACR,qCAAqC;QACrC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,sCAAsC,GAAG,+BAA+B,KAAK,SAAS;YAC1F,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,qBAAqB;gBACrB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,WAAW,EAAE,mBAAmB;gBACpH,CAAC,CAAC,SAAS,CAAC;QAEhB,yDAAyD;QACzD,sBAAsB,CACpB,WAAW,EACX,sCAAsC,CACvC,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,CAAC,CAAC,CAAC;IAEnE;;;OAGG;IACH,MAAM,2BAA2B,GAAG,CAClC,WAAwB,EACxB,iBAAwC,EACX,EAAE;QAC/B,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAa,CAAC;QAE1D,kEAAkE;QAClE,qDAAqD;QACrD,MAAM,wBAAwB,GAA6B,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE1D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,wBAAwB,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAa,CAAC;QAC7F,CAAC;QAED,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,wBAAwB;SACxC,CAAC;IACJ,CAAC,CAAC;IAEF;;OAEG;IACH,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAwB,EAGlE,EAAE;QACH,MAAM,cAAc,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE7D,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;YAC1D,CAAC,CAAC,YAAY,CAAC,iBAAiB,EAAE;YAClC,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,WAAW,GAAG,WAAW;YAC7B,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC;YACrE,CAAC,CAAC,cAAc,CAAC;QAEnB,QAAQ,CAAC,uBAAuB,EAAE;YAChC,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,eAAe,EAAE,WAAW,CAAC,MAAM;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;SACnD,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAA0B,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,mBAAmB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC5F,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;gBACpD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CACjE,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;gBACrD,EAAE,CAAC,kBAAkB,KAAK,IAAI;gBAC9B,EAAE,CAAC,eAAe,KAAK,IAAI;gBAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;oBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE,CACF,CAAC;YAEF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBACtD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,MAAM,0BAA0B,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,UAAU,CAAC,CAAC;YAErH,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAe,EAAE,EAAE;gBAC5D,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAC3B,0BAA0B,EAC1B,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;oBAE3E,OAAO,GAAG,CAAC;gBACb,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;oBAClG,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,iBAAiB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAA8B,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC;QAClG,CAAC;QAED,yCAAyC;QACzC,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACrD,MAAM,aAAa,GAAG,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC;YACrF,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;QAEtC,2CAA2C;QAC3C,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAExF,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACpC,4BAA4B,CAAC,aAAa,CAAC,CAAC;QAC5C,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAEpC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC,CAAC;QACxH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC,EAAE,CAAC,4BAA4B,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1F;;OAEG;IACH,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAmB,EAAoB,EAAE;QACrF,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAEnC,kCAAkC;QAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAE5E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEnF,MAAM,aAAa,GAAG,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CACjE,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;YACrD,EAAE,CAAC,kBAAkB,KAAK,IAAI;YAC9B,EAAE,CAAC,eAAe,KAAK,IAAI;YAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;gBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE,CACF,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,MAAM,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CAC/D,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;YACrD,EAAE,CAAC,eAAe,KAAK,IAAI;YAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;gBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE;YACD,EAAE,CAAC,UAAU,KAAK,qBAAqB,CAAC,OAAO,CAChD,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC;QAEnG,MAAM,oBAAoB,GAA2B,EAAE,CAAC;QAExD,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,gBAAgB,CAAsB,WAAW,CAAC,CAAC;gBACnE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,oBAAoB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC/C,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,MAAM,WAAW,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,aAAa,CAAC,CAAC;QACzG,MAAM,WAAW,GAAG,MAAM,WAAW,CAAc,WAAW,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,CAAC,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACxE,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEpG,oBAAoB;QACpB,OAAO,CAAC,WAAW,CAAC,CAAC;QAErB,gCAAgC;QAChC,+EAA+E;QAC/E,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAElF,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,WAAW,GAAG,WAAW,CAAC,kBAAkB,CAAC;QACnD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,mBAAmB,GAAG,aAAa;gBACvC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,aAAa,CAAC;gBAC9E,CAAC,CAAC,IAAI,CAAC;YACT,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC3C,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,iBAAiB,EAAE,gBAAgB;SACpC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,6EAA6E;IAC7E,SAAS,CAAC,GAAG,EAAE;QACb,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,OAAO,GAAG,EAAE;YACV,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,IAAI,oBAAoB,CAAC,OAAO,EAAE,CAAC;gBACjC,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC3C,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACtC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;;;;;;;OAUG;IACH,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,IAAsB,EAAE;QAC9D,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAEhD,+EAA+E;QAC/E,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YACrD,QAAQ,CAAC,gDAAgD,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,gEAAgE;QAChE,uEAAuE;QACvE,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBAEvD,IAAI,QAAQ,EAAE,CAAC;oBACb,mBAAmB,EAAE,CAAC;oBAEtB,mFAAmF;oBACnF,6EAA6E;oBAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;wBAC7C,oEAAoE;wBACpE,oEAAoE;wBACpE,oEAAoE;wBACpE,0DAA0D;wBAC1D,mEAAmE;wBACnE,2DAA2D;wBAC3D,mEAAmE;wBACnE,sEAAsE;wBACtE,wEAAwE;wBACxE,2EAA2E;wBAC3E,qEAAqE;wBACrE,2CAA2C;wBAC3C,MAAM,mBAAmB,GAAG,YAAY,CAAC,cAAc,EAAE,IAAI,WAAW,CAAC;wBACzE,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC;oBAC1E,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,+GAA+G,CAAC,CAAC;oBAC7H,UAAU,EAAE,CAAC;gBACf,CAAC;gBAED,OAAO,QAAQ,CAAC;YAElB,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,yEAAyE;gBACzE,uEAAuE;gBACvE,kEAAkE;gBAClE,qEAAqE;gBACrE,sEAAsE;gBACtE,0EAA0E;gBAC1E,kCAAkC;gBAClC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAE1E,IAAI,oBAAoB,EAAE,CAAC;oBACzB,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,8CAA8C,CAAC;oBACtF,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;wBACvE,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAC3B,mBAAmB,EAAE,CAAC;oBACtB,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,yEAAyE;gBACzE,sEAAsE;gBACtE,mEAAmE;gBACnE,yEAAyE;gBACzE,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrC,OAAO,IAAI,CAAC,CAAC;oBACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,2BAA2B,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAChD,0BAA0B,CAC3B,CAAC;oBACF,MAAM,CAAC,IAAI,CAAC,sFAAsF,EAAE;wBAClG,OAAO;wBACP,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;wBAC/B,IAAI,EAAE,KAAK,EAAE,IAAI;qBAClB,CAAC,CAAC;oBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;wBAClC,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC5D,CAAC,CAAC,CAAC;oBACH,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC9D,mBAAmB,CAAC,KAAK,CAAC,CAAC;wBAC3B,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClD,QAAQ,CAAC,wDAAwD,EAAE;wBACjE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,UAAU,EAAE,CAAC;oBACb,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,uEAAuE;gBACvE,wEAAwE;gBACxE,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,4BAA4B,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;oBAChF,KAAK,EAAE,YAAY;oBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI;iBACnC,CAAC,CAAC;gBAEH,UAAU,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC,EAAE;QACD,kBAAkB;QAClB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI;QACJ,UAAU;QACV,mBAAmB;QACnB,mBAAmB;QACnB,gBAAgB;QAChB,YAAY;KACb,CAAC,CAAC;IAEH;;OAEG;IACH,MAAM,oBAAoB,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACjE,qDAAqD;QACrD,MAAM,WAAW,GAAG,IAAI,EAAE,mBAAmB,IAAI,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,wCAAwC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,0BAA0B,EAAE,EAAE,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9E,mCAAmC;QACnC,MAAM,iBAAiB,CAAC,IAAK,CAAC,CAAC;IACjC,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE9B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,GAAG,qBAAqB;YAC/C,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC;YAClF,CAAC,CAAC,IAAI,CAAC;QAET,sBAAsB,CACpB,IAAI,CAAC,kBAAkB,EACvB,mBAAmB,EAAE,WAAW,EAAE,mBAAmB,CACtD,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,CAAC,cAAsB,EAAQ,EAAE;QAC1E,4DAA4D;QAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QAED,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;QAErD,0CAA0C;QAC1C,IAAI,sBAAsB,KAAK,cAAc,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,CAAC,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACjH,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC,EAAE,CAAC,aAAa,EAAE,qBAAqB,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,GAA+B,EAAE;QAC1E,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,qBAAqB,CAAC,IAAI,IAAI,CAAC;IAC1E,CAAC,EAAE,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC,CAAC;IAE3C;;OAEG;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,GAAuB,EAAE;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd;;OAEG;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAS,EAAE;QACpC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAE3F,4BAA4B;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACnC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAE7B,4BAA4B;QAC5B,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QAClC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEhC,0DAA0D;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE,UAAU,EAAE,4BAA4B,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAEzG,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,2CAA2C;QAC3C,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;YACvC,OAAO;QACT,CAAC;QAED,+BAA+B;QAC/B,IAAI,iBAAiB,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,+CAA+C,EAAE;YACxD,QAAQ,EAAE,CAAC,CAAC,WAAW;YACvB,aAAa,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO;SAC1C,CAAC,CAAC;QAEH,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;QACvC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEjC,6CAA6C;QAC7C,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/B,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5F,gDAAgD;IAChD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAClD,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;YACnC,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC7B,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QACpC,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,4BAA4B,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,OAAO,CAAsB,GAAG,EAAE,CAAC,CAAC;QAChD,0DAA0D;QAC1D,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QAEd,uEAAuE;QACvE,mBAAmB;QACnB,sBAAsB;QAEtB,YAAY;QACZ,IAAI;QAEJ,oBAAoB;QACpB,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QAExB,yCAAyC;QACzC,OAAO;QAEP,0BAA0B;QAC1B,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QAEpB,iBAAiB;QACjB,UAAU;KACX,CAAC,EAAE;QACF,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QACd,mBAAmB;QACnB,sBAAsB;QACtB,IAAI;QACJ,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QACxB,OAAO;QACP,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QACpB,UAAU;KACX,CAAC,CAAC;IAEH,OAAO,KAAC,eAAe,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA4B,CAAC;AACvF,CAAC,CAAC","sourcesContent":["import React, { createContext, useState, ReactNode, useMemo, useEffect, useCallback, useRef } from 'react';\nimport {\n  UserContext,\n  OrganizationContext,\n  CoreResourceType,\n  ResourcesConfig_OperationPathUtils,\n  CoreResourceOperation,\n  ResourceOperationVariantType,\n  OPERATION_VARIANT_KEY,\n  ExecutionContext_InitiatorIds,\n  UserPrivacy,\n  UserPreferences,\n  SessionType,\n} from '@wildo-ai/saas-models';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useEventBus } from '~wildo-frontend-lib/core/events/useEventBus';\nimport { FrontendEvents } from '~wildo-frontend-lib/core/events/events.frontend.schemas';\nimport {\n  EffectivePermissions,\n} from './security.frontend.schemas';\nimport { useAuthSession } from './useAuthSession';\nimport { AuthSessionUtils } from './auth-session.utils';\nimport { isTransientBackendFailure } from '~wildo-frontend-lib/core/requests/auth-refresh-resilience.frontend';\nimport { decodeJwtPayload } from './jwt.frontend.utils';\nimport { useAppScope } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { useAppScopeInternal } from '~wildo-frontend-lib/core/scope/AppScopeContext';\nimport { ScopeUtilsService } from '~wildo-frontend-lib/core/scope/scope.utils.frontend.service';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\nconst logDebug: (message: string, context?: Record<string, unknown>) => void = logger.debugByType('UserOrgsContext');\nlogger.setDebugTypeLogging('UserOrgsContext', false);\n\n/**\n * Session-restore retry backoff bounds (transient backend failures only).\n *\n * On RELOAD, a backend that is recompiling/restarting (dev) or briefly\n * unavailable (prod) makes the session-restore fetch fail transiently. Rather\n * than force a logout — which clears the shared `__wildo_refresh` cookie and\n * drops the user to the login screen — restore preserves the session and\n * retries with exponential backoff until the backend returns. Genuine auth/authz\n * and non-network errors do NOT retry (see `restoreSession`). Backoff caps so a\n * sustained outage settles at one attempt per {@link RESTORE_RETRY_MAX_DELAY_MS}.\n */\nconst RESTORE_RETRY_BASE_DELAY_MS = 1_000;\nconst RESTORE_RETRY_MAX_DELAY_MS = 30_000;\n\n/**\n * User Organizations Context\n * Manages user data, organizations, permissions, and preferences\n * Consumes AuthSessionContext for authentication state\n */\n\nexport interface UserOrgsContextType {\n  // Re-exported from AuthSession for backward compatibility\n  auth: ReturnType<typeof useAuthSession>['auth'];\n  identifyByEmail: ReturnType<typeof useAuthSession>['identifyByEmail'];\n  authenticateWithPassword: ReturnType<typeof useAuthSession>['authenticateWithPassword'];\n  authenticate: ReturnType<typeof useAuthSession>['authenticate'];\n  getSessionState: ReturnType<typeof useAuthSession>['getSessionState'];\n  isAuthenticated: ReturnType<typeof useAuthSession>['isAuthenticated'];\n  logout: () => void;\n  restoreSession: () => Promise<boolean>;\n\n  // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n  initiateOAuth2Login: ReturnType<typeof useAuthSession>['initiateOAuth2Login'];\n  handleAuthCodeExchange: ReturnType<typeof useAuthSession>['handleAuthCodeExchange'];\n\n  // User data\n  user: UserContext | null;\n\n  // Organization data\n  organizations: OrganizationContext[];\n  currentOrganizationId: string | null;\n  permissions: EffectivePermissions | null;\n  primaryScopeInitiatorIds: ExecutionContext_InitiatorIds | null;\n\n  // Privacy (only preference managed here, others are in their respective contexts)\n  privacy: UserPrivacy | null;\n\n  // Organization management\n  setCurrentOrganization: (organizationId: string) => void;\n  getCurrentOrganization: () => OrganizationContext | null;\n  refreshOrganizations: () => Promise<void>;\n\n  // Privacy getter\n  getPrivacy: () => UserPrivacy | null;\n}\n\n/**\n * UserOrgs Context\n * Exported for use in separate hook file (Fast Refresh compatibility)\n * @internal - Use useUserOrgs() hook instead of accessing this directly\n */\nexport const UserOrgsContext: React.Context<UserOrgsContextType | undefined> = createContext<UserOrgsContextType | undefined>(undefined);\n\nexport const UserOrgsProvider: React.FC<{ children: ReactNode }> = ({ children }) => {\n  const { doOperation, registry } = useResourceRegistry();\n  const { emit } = useEventBus();\n\n  // Consume auth session context\n  const authSession = useAuthSession();\n  const {\n    auth,\n    tokenStorage,\n    identifyByEmail,\n    authenticateWithPassword,\n    authenticate,\n    getSessionState,\n    isAuthenticated,\n    logout: authLogout,\n    initiateOAuth2Login,\n    handleAuthCodeExchange,\n    markSessionRestored,\n    setSessionRestoring,\n    connectWebSocket,\n  } = authSession;\n  const appScope = useAppScope();\n  const { commitOrganizationScopeValue } = useAppScopeInternal();\n  const currentOrganizationId = appScope.currentOrganizationId;\n\n  const hasInitializedRef = useRef(false);\n  const previousTokenRef = useRef<string | null>(null);\n  // Restore-retry lifecycle: `restoreAbortRef` flips true on unmount so an\n  // in-flight backoff loop bails instead of touching state on a dead component;\n  // `restoreRetryTimerRef` holds the pending backoff timer for cleanup.\n  const restoreAbortRef = useRef(false);\n  const restoreRetryTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);\n\n  const [user, setUser] = useState<UserContext | null>(null);\n\n  const [organizations, setOrganizations] = useState<OrganizationContext[]>([]);\n\n  const [permissions, setPermissions] = useState<{\n    appLevel: string[];\n    organizations: Record<string, string[]>;\n  } | null>(null);\n\n  const [privacy, setPrivacy] = useState<UserPrivacy | null>(null);\n\n  type PreferencesPayload = Pick<UserPreferences, 'languagePreferences' | 'regional' | 'ui' | 'notifications' | 'privacy'>;\n\n  const emitPreferencesChanged = useCallback((\n    preferences: PreferencesPayload | null | undefined,\n    organizationLanguagePreferences?: OrganizationContext['preferences']['languagePreferences'] | null,\n  ): void => {\n    if (preferences === null) {\n      emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n        languagePreferences: null,\n        organizationLanguagePreferences: null,\n        regionalPreferences: null,\n        notificationsPreferences: null,\n        uiPreferences: null,\n        privacy: null,\n      });\n      return;\n    }\n\n    emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n      ...(preferences?.languagePreferences !== undefined ? { languagePreferences: preferences.languagePreferences } : {}),\n      ...(organizationLanguagePreferences !== undefined ? { organizationLanguagePreferences } : {}),\n      ...(preferences?.regional !== undefined ? { regionalPreferences: preferences.regional } : {}),\n      ...(preferences?.notifications !== undefined ? { notificationsPreferences: preferences.notifications } : {}),\n      ...(preferences?.ui !== undefined ? { uiPreferences: preferences.ui } : {}),\n      ...(preferences?.privacy !== undefined ? { privacy: preferences.privacy } : {}),\n    });\n  }, [emit]);\n\n  const primaryScopeInitiatorIds = useMemo<ExecutionContext_InitiatorIds | null>(() => {\n    return ScopeUtilsService.buildInitiatorIds({\n      userId: appScope.currentUserId,\n      organizationId: appScope.currentOrganizationId,\n      applicationId: appScope.currentApplicationId,\n      anonymousUserId: appScope.currentAnonymousUserId,\n    });\n  }, [\n    appScope.currentApplicationId,\n    appScope.currentAnonymousUserId,\n    appScope.currentOrganizationId,\n    appScope.currentUserId,\n  ]);\n\n  /**\n   * Extract and store user preferences from context\n   * Stores preferences in state for other contexts to read and apply\n   */\n  const storePreferences = useCallback((\n    preferences: PreferencesPayload,\n    organizationLanguagePreferences?: OrganizationContext['preferences']['languagePreferences'] | null,\n  ): void => {\n    // Store privacy preferences in state\n    if (preferences.privacy) {\n      setPrivacy(preferences.privacy);\n    }\n\n    const currentOrganizationLanguagePreferences = organizationLanguagePreferences !== undefined\n      ? organizationLanguagePreferences\n      : currentOrganizationId\n        ? organizations.find((organization) => organization._id === currentOrganizationId)?.preferences?.languagePreferences\n        : undefined;\n\n    // Emit preference change event to notify parent contexts\n    emitPreferencesChanged(\n      preferences,\n      currentOrganizationLanguagePreferences,\n    );\n  }, [currentOrganizationId, emitPreferencesChanged, organizations]);\n\n  /**\n   * Compute effective permissions from user's app roles and organization roles\n   * This is a basic implementation - can be enhanced based on role hierarchy\n   */\n  const computeEffectivePermissions = (\n    userContext: UserContext,\n    organizationsList: OrganizationContext[]\n  ): EffectivePermissions | null => {\n    // App-level permissions from user's app roles\n    const appLevel = (userContext.appRoles || []) as string[];\n\n    // Per-organization permissions from organization membership roles\n    // Use new field name from relationship-based context\n    const organizationsPermissions: Record<string, string[]> = {};\n    const memberships = userContext.organizationMembers || [];\n\n    for (const membership of memberships) {\n      organizationsPermissions[membership.organizationId] = (membership.roles || []) as string[];\n    }\n\n    return {\n      appLevel,\n      organizations: organizationsPermissions,\n    };\n  };\n\n  /**\n   * Load organizations independently (can be called separately from authentication)\n   */\n  const loadOrganizations = useCallback(async (userContext: UserContext): Promise<{\n    organizationsList: OrganizationContext[];\n    selectedOrgId: string | null;\n  }> => {\n    const allMemberships = userContext.organizationMembers || [];\n\n    // W7.3b: For one-off sessions, restrict to the scoped organization only\n    const scopedOrgId = auth.sessionType === SessionType.ONE_OFF\n      ? tokenStorage.getOrganizationId()\n      : null;\n\n    const memberships = scopedOrgId\n      ? allMemberships.filter((m: any) => m.organizationId === scopedOrgId)\n      : allMemberships;\n\n    logDebug('Loading organizations', {\n      userId: userContext._id,\n      membershipCount: memberships.length,\n      isOneOff: auth.sessionType === SessionType.ONE_OFF,\n    });\n\n    const organizationsList: OrganizationContext[] = [];\n\n    if (memberships.length > 0) {\n      const organizationsConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];\n      if (!organizationsConfig) {\n        logger.warn('ORGANIZATIONS resource not available');\n        return { organizationsList, selectedOrgId: null };\n      }\n\n      const orgsReadOp = organizationsConfig.operations.find((op: any) =>\n        op.operationIdentifier === CoreResourceOperation.READ &&\n        op.isOperationDefault === true &&\n        op.isBulkOperation !== true &&\n        (\n          op.variantType === ResourceOperationVariantType.API_CALL ||\n          op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n        )\n      );\n\n      if (!orgsReadOp) {\n        logger.warn('ORGANIZATIONS READ operation not found');\n        return { organizationsList, selectedOrgId: null };\n      }\n\n      const organizationsOperationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(orgsReadOp);\n\n      const orgPromises = memberships.map(async (membership: any) => {\n        try {\n          const org = await doOperation<OrganizationContext>(\n            organizationsOperationPath,\n            { contextualParameters: { organizationId: membership.organizationId } });\n\n          return org;\n        } catch (error) {\n          logger.warn('Failed to fetch organization', { organizationId: membership.organizationId, error });\n          return null;\n        }\n      });\n\n      const orgResults = await Promise.all(orgPromises);\n      organizationsList.push(...orgResults.filter((org): org is OrganizationContext => org !== null));\n    }\n\n    // Restore current organization selection\n    const storedOrgId = tokenStorage.getOrganizationId();\n    const selectedOrgId = storedOrgId && organizationsList.find(o => o._id === storedOrgId)\n      ? storedOrgId\n      : organizationsList[0]?._id || null;\n\n    // Compute effective permissions from roles\n    const computedPermissions = computeEffectivePermissions(userContext, organizationsList);\n\n    setOrganizations(organizationsList);\n    commitOrganizationScopeValue(selectedOrgId);\n    setPermissions(computedPermissions);\n\n    logDebug('Organizations loaded', { organizationCount: organizationsList.length, currentOrganizationId: selectedOrgId });\n    return { organizationsList, selectedOrgId };\n  }, [commitOrganizationScopeValue, doOperation, registry, tokenStorage, auth.sessionType]);\n\n  /**\n   * Restore regular user session\n   */\n  const restoreUserSession = useCallback(async (accessToken: string): Promise<boolean> => {\n    logDebug('Restoring user session');\n\n    // Check if USER_SELF is available\n    const availableResources = Object.keys(registry.resourceConfigurations);\n    const hasUserSelf = availableResources.includes(CoreResourceType.USER_SELF);\n\n    if (!hasUserSelf) {\n      logger.warn('USER_SELF resource not available for session restoration');\n      return false;\n    }\n\n    // Get USER_SELF resource config\n    const userSelfConfig = registry.resourceConfigurations[CoreResourceType.USER_SELF];\n\n    const readOperation = userSelfConfig?.operations?.find((op: any) =>\n      op.operationIdentifier === CoreResourceOperation.READ &&\n      op.isOperationDefault === true &&\n      op.isBulkOperation !== true &&\n      (\n        op.variantType === ResourceOperationVariantType.API_CALL ||\n        op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n      )\n    );\n\n    if (!readOperation) {\n      logger.warn('USER_SELF READ operation not found');\n      return false;\n    }\n\n    // Find context variant (auto-generated with relationship population)\n    const readContextOp = userSelfConfig.operations.find((op: any) =>\n      op.operationIdentifier === CoreResourceOperation.READ &&\n      op.isBulkOperation !== true &&\n      (\n        op.variantType === ResourceOperationVariantType.API_CALL ||\n        op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n      ) &&\n      op.variantKey === OPERATION_VARIANT_KEY.CONTEXT\n    );\n\n    if (!readContextOp) {\n      logger.warn('USER_SELF context variant not found');\n      return false;\n    }\n\n    const initiatorInfo = readOperation.initiatorInfos?.[0];\n    const requiresUserId = initiatorInfo?.parameters?.some((p: any) => p.fieldIdentifier === 'userId');\n\n    const contextualParameters: Record<string, string> = {};\n\n    if (requiresUserId && accessToken) {\n      try {\n        const payload = decodeJwtPayload<{ userId?: string }>(accessToken);\n        if (payload.userId) {\n          contextualParameters.userId = payload.userId;\n        }\n      } catch (e) {\n        logDebug('Failed to decode JWT for userId extraction', { error: e });\n      }\n    }\n\n    // Build operation path and fetch user context\n    const contextPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readContextOp);\n    const userContext = await doOperation<UserContext>(contextPath, { contextualParameters });\n\n    if (!userContext) {\n      logger.warn('Failed to fetch user context during session restoration');\n      return false;\n    }\n\n    // Use new field name from relationship-based context\n    const membershipsCount = (userContext.organizationMembers || []).length;\n    logDebug('User context restored', { userId: userContext._id, organizationCount: membershipsCount });\n\n    // Update user state\n    setUser(userContext);\n\n    // Load organizations separately\n    // If this fails, session restoration still succeeds (user context is restored)\n    const { organizationsList, selectedOrgId } = await loadOrganizations(userContext);\n\n    // Store preferences after organization loading so i18n receives user and\n    // active-organization language policy in the same event.\n    const preferences = userContext.userSelfPreference;\n    if (preferences) {\n      const currentOrganization = selectedOrgId\n        ? organizationsList.find((organization) => organization._id === selectedOrgId)\n        : null;\n      storePreferences(preferences, currentOrganization?.preferences?.languagePreferences);\n    }\n\n    logger.info('Session restored successfully', {\n      userId: userContext._id,\n      organizationCount: membershipsCount\n    });\n\n    return true;\n  }, [doOperation, registry, loadOrganizations, storePreferences]);\n\n  // Stop any pending restore-retry backoff when the provider unmounts, so the\n  // loop in `restoreSession` bails instead of calling setState on a dead tree.\n  useEffect(() => {\n    restoreAbortRef.current = false;\n    return () => {\n      restoreAbortRef.current = true;\n      if (restoreRetryTimerRef.current) {\n        clearTimeout(restoreRetryTimerRef.current);\n        restoreRetryTimerRef.current = null;\n      }\n    };\n  }, []);\n\n  /**\n   * Restore session from stored JWT token\n   * Fetches user context using USER_SELF resource (userId comes from JWT)\n   * Then fetches full organization details for each organization membership\n   *\n   * Resilience: a TRANSIENT backend failure (unreachable / 5xx / timeout, or a\n   * 401 whose in-flight renewal failed transiently) does NOT log out — restore\n   * preserves the session and retries with capped exponential backoff until the\n   * backend returns. Genuine authentication (401), authorization (403), and\n   * non-network errors terminate immediately (no retry on a dead-or-buggy path).\n   */\n  const restoreSession = useCallback(async (): Promise<boolean> => {\n    logDebug('Restoring session from stored token');\n\n    // Check if session is already restored to avoid duplicate restoration attempts\n    if (auth.sessionRestored && auth.accessToken && user) {\n      logDebug('Session already restored, skipping restoration');\n      return true;\n    }\n\n    // Read token from auth state\n    const accessToken = auth.accessToken;\n\n    if (!accessToken) {\n      logDebug('No access token available');\n      return false;\n    }\n\n    setSessionRestoring(true);\n\n    let attempt = 0;\n    // Single backoff loop: the invoking effect won't re-enter while\n    // `isRestoringSession` is true, so this is the sole restore in flight.\n    while (true) {\n      try {\n        const restored = await restoreUserSession(accessToken);\n\n        if (restored) {\n          markSessionRestored();\n\n          // W7.3b: One-off sessions already connected WebSocket in handleOneOffTokenExchange\n          // (with consumableToken). Reconnecting here would lose the consumable token.\n          if (auth.sessionType !== SessionType.ONE_OFF) {\n            // Connect with the FRESHEST token, read live from storage — NOT the\n            // `accessToken` captured at the top of `restoreSession`. During the\n            // awaited `restoreUserSession` above, the HTTP interceptor may have\n            // hit a `401 OUTDATED_AUTH_JWT` and rotated the token via\n            // `tokenRenewalHandler` (which writes the new token to storage AND\n            // seeds the WS `authStateRef` synchronously). The captured\n            // `accessToken` is then stale/expired; passing it into `connect()`\n            // reseeds the WS credential source-of-truth back to the expired token\n            // (clobbering the fresh one the refresh just stored), and the Socket.IO\n            // handshake gets rejected with \"Authentication failed\". `getAccessToken()`\n            // returns the live, post-refresh value (falling back to the captured\n            // token only if storage is somehow empty).\n            const freshestAccessToken = tokenStorage.getAccessToken() ?? accessToken;\n            connectWebSocket(freshestAccessToken, tokenStorage.getOrganizationId());\n          }\n        } else {\n          logger.warn('Session restoration could not build a valid authenticated context; logging out to avoid a half-restored state');\n          authLogout();\n        }\n\n        return restored;\n\n      } catch (error: any) {\n        // Authorization (403 / scope) is checked FIRST and is non-destructive: a\n        // permission denial must NEVER destroy a valid session. Authentication\n        // (401 / session-invalid) is the only branch that force-logs-out.\n        // `isAuthenticationError` already excludes authorization errors (see\n        // `AuthSessionUtils`), so these are mutually exclusive — the explicit\n        // ordering here is defense-in-depth so the non-destructive path wins even\n        // if that guard is ever loosened.\n        const isAuthorizationError = AuthSessionUtils.isAuthorizationError(error);\n\n        if (isAuthorizationError) {\n          const errorMessage = error?.message || 'Session restoration blocked by authorization';\n          logger.warn('Session restoration encountered authorization/scope error', {\n            error: errorMessage,\n            errorType: error?.wildoError?.type || error?.response?.data?.error?.type,\n            status: error?.response?.status,\n          });\n          setSessionRestoring(false);\n          markSessionRestored();\n          return false;\n        }\n\n        // TRANSIENT backend failure (checked BEFORE the authentication branch so\n        // a 401 whose renewal failed transiently is retried, not logged out):\n        // preserve the session, back off, and retry. Bail if the component\n        // unmounted or the session was cleared (logout elsewhere) while waiting.\n        if (isTransientBackendFailure(error)) {\n          attempt += 1;\n          const delay = Math.min(\n            RESTORE_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1),\n            RESTORE_RETRY_MAX_DELAY_MS,\n          );\n          logger.warn('Session restoration hit a transient backend failure; preserving session and retrying', {\n            attempt,\n            retryInMs: delay,\n            status: error?.response?.status,\n            code: error?.code,\n          });\n          await new Promise<void>((resolve) => {\n            restoreRetryTimerRef.current = setTimeout(resolve, delay);\n          });\n          if (restoreAbortRef.current || !tokenStorage.getAccessToken()) {\n            setSessionRestoring(false);\n            return false;\n          }\n          continue;\n        }\n\n        if (AuthSessionUtils.isAuthenticationError(error)) {\n          logDebug('Session restoration failed due to authentication error', {\n            errorType: error?.wildoError?.type || error?.response?.data?.error?.type,\n            status: error?.response?.status,\n          });\n          authLogout();\n          return false;\n        }\n\n        // Fail closed on unexpected NON-transient errors. A partially restored\n        // authenticated shell is less safe than dropping back to a clean login.\n        const errorMessage = error?.message || 'Session restoration failed';\n        logger.warn('Session restoration encountered a non-transient error; logging out', {\n          error: errorMessage,\n          errorType: error?.wildoError?.type,\n        });\n\n        authLogout();\n        return false;\n      }\n    }\n  }, [\n    restoreUserSession,\n    auth.sessionRestored,\n    auth.sessionType,\n    auth.accessToken,\n    user,\n    authLogout,\n    markSessionRestored,\n    setSessionRestoring,\n    connectWebSocket,\n    tokenStorage\n  ]);\n\n  /**\n   * Refresh organizations data (e.g., after organization update)\n   */\n  const refreshOrganizations = useCallback(async (): Promise<void> => {\n    // Use new field name from relationship-based context\n    const memberships = user?.organizationMembers || [];\n\n    if (memberships.length === 0) {\n      logDebug('No organizations membership to refresh');\n      return;\n    }\n\n    logDebug('Refreshing organizations', { membershipCount: memberships.length });\n\n    // Use loadOrganizations to refresh\n    await loadOrganizations(user!);\n  }, [user, loadOrganizations]);\n\n  useEffect(() => {\n    if (!user?.userSelfPreference) {\n      return;\n    }\n\n    const currentOrganization = currentOrganizationId\n      ? organizations.find((organization) => organization._id === currentOrganizationId)\n      : null;\n\n    emitPreferencesChanged(\n      user.userSelfPreference,\n      currentOrganization?.preferences?.languagePreferences,\n    );\n  }, [currentOrganizationId, emitPreferencesChanged, organizations, user]);\n\n  /**\n   * Set the current active organization\n   */\n  const setCurrentOrganization = useCallback((organizationId: string): void => {\n    // Validate that organization exists in user's organizations\n    const org = organizations.find(o => o._id === organizationId);\n    if (!org) {\n      logger.warn('Attempted to set invalid organization', { organizationId, availableOrganizations: organizations.map(o => o._id) });\n      return;\n    }\n\n    const previousOrganizationId = currentOrganizationId;\n\n    // Skip if the organization hasn't changed\n    if (previousOrganizationId === organizationId) {\n      return;\n    }\n\n    logDebug('Setting current organization', { organizationId, organizationName: org.name, previousOrganizationId });\n    commitOrganizationScopeValue(organizationId);\n  }, [organizations, currentOrganizationId, commitOrganizationScopeValue]);\n\n  /**\n   * Get the current active organization\n   */\n  const getCurrentOrganization = useCallback((): OrganizationContext | null => {\n    if (!currentOrganizationId) {\n      return null;\n    }\n    return organizations.find(o => o._id === currentOrganizationId) || null;\n  }, [currentOrganizationId, organizations]);\n\n  /**\n   * Get privacy preferences\n   */\n  const getPrivacy = useCallback((): UserPrivacy | null => {\n    return privacy;\n  }, [privacy]);\n\n  /**\n   * Logout wrapper that also clears user/org data\n   */\n  const logout = useCallback((): void => {\n    logDebug('Logging out user', { userId: user?._id, organizationId: currentOrganizationId });\n\n    // Clear user/org data first\n    setUser(null);\n    setOrganizations([]);\n    commitOrganizationScopeValue(null);\n    setPermissions(null);\n    setPrivacy(null);\n    emitPreferencesChanged(null);\n\n    // Reset initialization flag\n    hasInitializedRef.current = false;\n    previousTokenRef.current = null;\n\n    // Call auth logout (clears tokens, disconnects WebSocket)\n    authLogout();\n  }, [user?._id, currentOrganizationId, authLogout, commitOrganizationScopeValue, emitPreferencesChanged]);\n\n  // Auto-load user/org data when token becomes available\n  useEffect(() => {\n    const accessToken = auth.accessToken;\n\n    // Skip if no token or token hasn't changed\n    if (!accessToken || accessToken === previousTokenRef.current) {\n      return;\n    }\n\n    // Skip if session is already restored with this token\n    if (auth.sessionRestored && user) {\n      previousTokenRef.current = accessToken;\n      return;\n    }\n\n    // Skip if already initializing\n    if (hasInitializedRef.current && auth.isRestoringSession) {\n      return;\n    }\n\n    logDebug('Token changed, initiating session restoration', {\n      hasToken: !!accessToken,\n      previousToken: !!previousTokenRef.current\n    });\n\n    previousTokenRef.current = accessToken;\n    hasInitializedRef.current = true;\n\n    // Restore session (will fetch user/org data)\n    restoreSession().catch((error) => {\n      logger.error('Session restoration failed', { error });\n    });\n  }, [auth.accessToken, auth.sessionRestored, auth.isRestoringSession, user, restoreSession]);\n\n  // Clear data when token is removed (logged out)\n  useEffect(() => {\n    if (!auth.accessToken && previousTokenRef.current) {\n      logDebug('Token removed, clearing user/org data');\n      setUser(null);\n      setOrganizations([]);\n      commitOrganizationScopeValue(null);\n      setPermissions(null);\n      setPrivacy(null);\n      emitPreferencesChanged(null);\n      previousTokenRef.current = null;\n      hasInitializedRef.current = false;\n    }\n  }, [auth.accessToken, commitOrganizationScopeValue, emitPreferencesChanged]);\n\n  const value = useMemo<UserOrgsContextType>(() => ({\n    // Re-exported from AuthSession for backward compatibility\n    auth,\n    identifyByEmail,\n    authenticateWithPassword,\n    authenticate,\n    getSessionState,\n    isAuthenticated,\n    logout,\n    restoreSession,\n\n    // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n    initiateOAuth2Login,\n    handleAuthCodeExchange,\n\n    // User data\n    user,\n\n    // Organization data\n    organizations,\n    currentOrganizationId,\n    permissions,\n    primaryScopeInitiatorIds,\n\n    // Privacy (only preference managed here)\n    privacy,\n\n    // Organization management\n    setCurrentOrganization,\n    getCurrentOrganization,\n    refreshOrganizations,\n\n    // Privacy getter\n    getPrivacy,\n  }), [\n    auth,\n    identifyByEmail,\n    authenticateWithPassword,\n    authenticate,\n    getSessionState,\n    isAuthenticated,\n    logout,\n    restoreSession,\n    initiateOAuth2Login,\n    handleAuthCodeExchange,\n    user,\n    organizations,\n    currentOrganizationId,\n    permissions,\n    primaryScopeInitiatorIds,\n    privacy,\n    setCurrentOrganization,\n    getCurrentOrganization,\n    refreshOrganizations,\n    getPrivacy,\n  ]);\n\n  return <UserOrgsContext.Provider value={value}>{children}</UserOrgsContext.Provider>;\n};\n\n// useUserOrgs hook is now in separate file: ./useUserOrgs.ts\n// This separation is required for React Fast Refresh compatibility\n"]}
+{"version":3,"file":"UserOrgsContext.js","sourceRoot":"","sources":["../../../../src/core/security/UserOrgsContext.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,aAAa,EAAE,QAAQ,EAAa,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC3G,OAAO,EAGL,gBAAgB,EAChB,kCAAkC,EAClC,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EAIrB,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,6CAA6C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAIzF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAEhG,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AACxE,MAAM,QAAQ,GAAiE,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;AACrH,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AA4C1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmD,aAAa,CAAkC,SAAS,CAAC,CAAC;AAEzI,MAAM,CAAC,MAAM,gBAAgB,GAAsC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IAClF,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAE/B,+BAA+B;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,MAAM,EAAE,UAAU,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,GAAG,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,4BAA4B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC/D,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IAE7D,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,gBAAgB,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IACrD,yEAAyE;IACzE,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,oBAAoB,GAAG,MAAM,CAAuC,IAAI,CAAC,CAAC;IAEhF,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAE3D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAwB,EAAE,CAAC,CAAC;IAE9E,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAGpC,IAAI,CAAC,CAAC;IAEhB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAIjE;;;;;;;;;OASG;IACH,MAAM,8BAA8B,GAAG,CACrC,uBAA8E,EACrD,EAAE;QAC3B,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,uBAAuB,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,+BAA+B,EAAE,uBAAuB,CAAC,mBAAmB,IAAI,IAAI;YACpF,+BAA+B,EAAE;gBAC/B,QAAQ,EAAE,uBAAuB,CAAC,QAAQ;gBAC1C,MAAM,EAAE,uBAAuB,CAAC,MAAM;gBACtC,UAAU,EAAE,uBAAuB,CAAC,UAAU;gBAC9C,UAAU,EAAE,uBAAuB,CAAC,UAAU;aAC/C;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,sBAAsB,GAAG,WAAW,CAAC,CACzC,WAAkD,EAClD,uBAAmE,EAC7D,EAAE;QACR,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;gBAC5C,mBAAmB,EAAE,IAAI;gBACzB,+BAA+B,EAAE,IAAI;gBACrC,mBAAmB,EAAE,IAAI;gBACzB,+BAA+B,EAAE,IAAI;gBACrC,wBAAwB,EAAE,IAAI;gBAC9B,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;YAC5C,GAAG,CAAC,WAAW,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnH,GAAG,8BAA8B,CAAC,uBAAuB,CAAC;YAC1D,GAAG,CAAC,WAAW,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,WAAW,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,MAAM,wBAAwB,GAAG,OAAO,CAAuC,GAAG,EAAE;QAClF,OAAO,iBAAiB,CAAC,iBAAiB,CAAC;YACzC,MAAM,EAAE,QAAQ,CAAC,aAAa;YAC9B,cAAc,EAAE,QAAQ,CAAC,qBAAqB;YAC9C,aAAa,EAAE,QAAQ,CAAC,oBAAoB;YAC5C,eAAe,EAAE,QAAQ,CAAC,sBAAsB;SACjD,CAAC,CAAC;IACL,CAAC,EAAE;QACD,QAAQ,CAAC,oBAAoB;QAC7B,QAAQ,CAAC,sBAAsB;QAC/B,QAAQ,CAAC,qBAAqB;QAC9B,QAAQ,CAAC,aAAa;KACvB,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,CACnC,WAA+B,EAC/B,uBAAmE,EAC7D,EAAE;QACR,qCAAqC;QACrC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,8BAA8B,GAAG,uBAAuB,KAAK,SAAS;YAC1E,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,qBAAqB;gBACrB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,WAAW;gBAC/F,CAAC,CAAC,SAAS,CAAC;QAEhB,yDAAyD;QACzD,sBAAsB,CACpB,WAAW,EACX,8BAA8B,CAC/B,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,CAAC,CAAC,CAAC;IAEnE;;;OAGG;IACH,MAAM,2BAA2B,GAAG,CAClC,WAAwB,EACxB,iBAAwC,EACX,EAAE;QAC/B,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAa,CAAC;QAE1D,kEAAkE;QAClE,qDAAqD;QACrD,MAAM,wBAAwB,GAA6B,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE1D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,wBAAwB,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAa,CAAC;QAC7F,CAAC;QAED,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,wBAAwB;SACxC,CAAC;IACJ,CAAC,CAAC;IAEF;;OAEG;IACH,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAwB,EAGlE,EAAE;QACH,MAAM,cAAc,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE7D,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;YAC1D,CAAC,CAAC,YAAY,CAAC,iBAAiB,EAAE;YAClC,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,WAAW,GAAG,WAAW;YAC7B,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC;YACrE,CAAC,CAAC,cAAc,CAAC;QAEnB,QAAQ,CAAC,uBAAuB,EAAE;YAChC,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,eAAe,EAAE,WAAW,CAAC,MAAM;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;SACnD,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAA0B,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,mBAAmB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC5F,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;gBACpD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CACjE,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;gBACrD,EAAE,CAAC,kBAAkB,KAAK,IAAI;gBAC9B,EAAE,CAAC,eAAe,KAAK,IAAI;gBAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;oBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE,CACF,CAAC;YAEF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBACtD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,MAAM,0BAA0B,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,UAAU,CAAC,CAAC;YAErH;;;;;;;;;;;;;;;;;;;;;;eAsBG;YACH,MAAM,6BAA6B,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;YACjH,MAAM,6BAA6B,GAAG,6BAA6B,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CAChG,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;gBACrD,EAAE,CAAC,kBAAkB,KAAK,IAAI;gBAC9B,EAAE,CAAC,eAAe,KAAK,IAAI;gBAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;oBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE,CACF,CAAC;YAEF,IAAI,CAAC,6BAA6B,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;YAClH,CAAC;YAED,MAAM,oCAAoC,GAAG,6BAA6B;gBACxE,CAAC,CAAC,kCAAkC,CAAC,kCAAkC,CAAC,6BAA6B,CAAC;gBACtG,CAAC,CAAC,IAAI,CAAC;YAET,MAAM,4BAA4B,GAAG,KAAK,EACxC,cAAsB,EACmC,EAAE;gBAC3D,IAAI,CAAC,oCAAoC;oBAAE,OAAO,SAAS,CAAC;gBAC5D,IAAI,CAAC;oBACH,OAAO,MAAM,WAAW,CACtB,oCAAoC,EACpC,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,EAAE,CAC7C,IAAI,SAAS,CAAC;gBACjB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;oBACnF,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAe,EAAE,EAAE;gBAC5D,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBAC3C,WAAW,CACT,0BAA0B,EAC1B,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC1E,4BAA4B,CAAC,UAAU,CAAC,cAAc,CAAC;qBACxD,CAAC,CAAC;oBAEH,IAAI,CAAC,GAAG;wBAAE,OAAO,IAAI,CAAC;oBACtB,sFAAsF;oBACtF,uFAAuF;oBACvF,sFAAsF;oBACtF,qFAAqF;oBACrF,8BAA8B;oBAC9B,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACrD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;oBAClG,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,iBAAiB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAA8B,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC;QAClG,CAAC;QAED,yCAAyC;QACzC,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACrD,MAAM,aAAa,GAAG,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC;YACrF,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;QAEtC,2CAA2C;QAC3C,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAExF,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACpC,4BAA4B,CAAC,aAAa,CAAC,CAAC;QAC5C,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAEpC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC,CAAC;QACxH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC,EAAE,CAAC,4BAA4B,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1F;;OAEG;IACH,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAmB,EAAoB,EAAE;QACrF,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAEnC,kCAAkC;QAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAE5E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEnF,MAAM,aAAa,GAAG,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CACjE,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;YACrD,EAAE,CAAC,kBAAkB,KAAK,IAAI;YAC9B,EAAE,CAAC,eAAe,KAAK,IAAI;YAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;gBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE,CACF,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,MAAM,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CAC/D,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;YACrD,EAAE,CAAC,eAAe,KAAK,IAAI;YAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;gBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE;YACD,EAAE,CAAC,UAAU,KAAK,qBAAqB,CAAC,OAAO,CAChD,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC;QAEnG,MAAM,oBAAoB,GAA2B,EAAE,CAAC;QAExD,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,gBAAgB,CAAsB,WAAW,CAAC,CAAC;gBACnE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,oBAAoB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC/C,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,MAAM,WAAW,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,aAAa,CAAC,CAAC;QACzG,MAAM,WAAW,GAAG,MAAM,WAAW,CAAc,WAAW,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,CAAC,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACxE,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEpG,oBAAoB;QACpB,OAAO,CAAC,WAAW,CAAC,CAAC;QAErB,gCAAgC;QAChC,+EAA+E;QAC/E,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAElF,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,mBAAmB,GAAG,aAAa;gBACvC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,aAAa,CAAC;gBAC9E,CAAC,CAAC,IAAI,CAAC;YACT,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC3C,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,iBAAiB,EAAE,gBAAgB;SACpC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,6EAA6E;IAC7E,SAAS,CAAC,GAAG,EAAE;QACb,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,OAAO,GAAG,EAAE;YACV,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,IAAI,oBAAoB,CAAC,OAAO,EAAE,CAAC;gBACjC,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC3C,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACtC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;;;;;;;OAUG;IACH,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,IAAsB,EAAE;QAC9D,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAEhD,+EAA+E;QAC/E,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YACrD,QAAQ,CAAC,gDAAgD,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,gEAAgE;QAChE,uEAAuE;QACvE,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBAEvD,IAAI,QAAQ,EAAE,CAAC;oBACb,mBAAmB,EAAE,CAAC;oBAEtB,mFAAmF;oBACnF,6EAA6E;oBAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;wBAC7C,oEAAoE;wBACpE,oEAAoE;wBACpE,oEAAoE;wBACpE,0DAA0D;wBAC1D,mEAAmE;wBACnE,2DAA2D;wBAC3D,mEAAmE;wBACnE,sEAAsE;wBACtE,wEAAwE;wBACxE,2EAA2E;wBAC3E,qEAAqE;wBACrE,2CAA2C;wBAC3C,MAAM,mBAAmB,GAAG,YAAY,CAAC,cAAc,EAAE,IAAI,WAAW,CAAC;wBACzE,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC;oBAC1E,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,+GAA+G,CAAC,CAAC;oBAC7H,UAAU,EAAE,CAAC;gBACf,CAAC;gBAED,OAAO,QAAQ,CAAC;YAElB,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,yEAAyE;gBACzE,uEAAuE;gBACvE,kEAAkE;gBAClE,qEAAqE;gBACrE,sEAAsE;gBACtE,0EAA0E;gBAC1E,kCAAkC;gBAClC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAE1E,IAAI,oBAAoB,EAAE,CAAC;oBACzB,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,8CAA8C,CAAC;oBACtF,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;wBACvE,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAC3B,mBAAmB,EAAE,CAAC;oBACtB,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,yEAAyE;gBACzE,sEAAsE;gBACtE,mEAAmE;gBACnE,yEAAyE;gBACzE,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrC,OAAO,IAAI,CAAC,CAAC;oBACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,2BAA2B,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAChD,0BAA0B,CAC3B,CAAC;oBACF,MAAM,CAAC,IAAI,CAAC,sFAAsF,EAAE;wBAClG,OAAO;wBACP,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;wBAC/B,IAAI,EAAE,KAAK,EAAE,IAAI;qBAClB,CAAC,CAAC;oBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;wBAClC,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC5D,CAAC,CAAC,CAAC;oBACH,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC9D,mBAAmB,CAAC,KAAK,CAAC,CAAC;wBAC3B,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClD,QAAQ,CAAC,wDAAwD,EAAE;wBACjE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,UAAU,EAAE,CAAC;oBACb,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,uEAAuE;gBACvE,wEAAwE;gBACxE,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,4BAA4B,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;oBAChF,KAAK,EAAE,YAAY;oBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI;iBACnC,CAAC,CAAC;gBAEH,UAAU,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC,EAAE;QACD,kBAAkB;QAClB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI;QACJ,UAAU;QACV,mBAAmB;QACnB,mBAAmB;QACnB,gBAAgB;QAChB,YAAY;KACb,CAAC,CAAC;IAEH;;OAEG;IACH,MAAM,oBAAoB,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACjE,qDAAqD;QACrD,MAAM,WAAW,GAAG,IAAI,EAAE,mBAAmB,IAAI,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,wCAAwC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,0BAA0B,EAAE,EAAE,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9E,mCAAmC;QACnC,MAAM,iBAAiB,CAAC,IAAK,CAAC,CAAC;IACjC,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE9B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,GAAG,qBAAqB;YAC/C,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC;YAClF,CAAC,CAAC,IAAI,CAAC;QAET,sBAAsB,CACpB,IAAI,CAAC,mBAAmB,EACxB,mBAAmB,EAAE,WAAW,CACjC,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,CAAC,cAAsB,EAAQ,EAAE;QAC1E,4DAA4D;QAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QAED,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;QAErD,0CAA0C;QAC1C,IAAI,sBAAsB,KAAK,cAAc,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,CAAC,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACjH,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC,EAAE,CAAC,aAAa,EAAE,qBAAqB,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,GAA+B,EAAE;QAC1E,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,qBAAqB,CAAC,IAAI,IAAI,CAAC;IAC1E,CAAC,EAAE,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC,CAAC;IAE3C;;OAEG;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,GAAuB,EAAE;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd;;OAEG;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAS,EAAE;QACpC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAE3F,4BAA4B;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACnC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAE7B,4BAA4B;QAC5B,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QAClC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEhC,0DAA0D;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE,UAAU,EAAE,4BAA4B,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAEzG,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,2CAA2C;QAC3C,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;YACvC,OAAO;QACT,CAAC;QAED,+BAA+B;QAC/B,IAAI,iBAAiB,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,+CAA+C,EAAE;YACxD,QAAQ,EAAE,CAAC,CAAC,WAAW;YACvB,aAAa,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO;SAC1C,CAAC,CAAC;QAEH,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;QACvC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEjC,6CAA6C;QAC7C,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/B,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5F,gDAAgD;IAChD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAClD,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;YACnC,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC7B,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QACpC,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,4BAA4B,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,OAAO,CAAsB,GAAG,EAAE,CAAC,CAAC;QAChD,0DAA0D;QAC1D,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QAEd,uEAAuE;QACvE,mBAAmB;QACnB,sBAAsB;QAEtB,YAAY;QACZ,IAAI;QAEJ,oBAAoB;QACpB,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QAExB,yCAAyC;QACzC,OAAO;QAEP,0BAA0B;QAC1B,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QAEpB,iBAAiB;QACjB,UAAU;KACX,CAAC,EAAE;QACF,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QACd,mBAAmB;QACnB,sBAAsB;QACtB,IAAI;QACJ,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QACxB,OAAO;QACP,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QACpB,UAAU;KACX,CAAC,CAAC;IAEH,OAAO,KAAC,eAAe,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA4B,CAAC;AACvF,CAAC,CAAC","sourcesContent":["import React, { createContext, useState, ReactNode, useMemo, useEffect, useCallback, useRef } from 'react';\nimport {\n  UserContext,\n  OrganizationContext,\n  CoreResourceType,\n  ResourcesConfig_OperationPathUtils,\n  CoreResourceOperation,\n  ResourceOperationVariantType,\n  OPERATION_VARIANT_KEY,\n  ExecutionContext_InitiatorIds,\n  UserPrivacy,\n  UserPreferences,\n  SessionType,\n} from '@wildo-ai/saas-models';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useEventBus } from '~wildo-frontend-lib/core/events/useEventBus';\nimport { FrontendEvents } from '~wildo-frontend-lib/core/events/events.frontend.schemas';\nimport {\n  EffectivePermissions,\n} from './security.frontend.schemas';\nimport { useAuthSession } from './useAuthSession';\nimport { AuthSessionUtils } from './auth-session.utils';\nimport { isTransientBackendFailure } from '~wildo-frontend-lib/core/requests/auth-refresh-resilience.frontend';\nimport { decodeJwtPayload } from './jwt.frontend.utils';\nimport { useAppScope } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { useAppScopeInternal } from '~wildo-frontend-lib/core/scope/AppScopeContext';\nimport { ScopeUtilsService } from '~wildo-frontend-lib/core/scope/scope.utils.frontend.service';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\nconst logDebug: (message: string, context?: Record<string, unknown>) => void = logger.debugByType('UserOrgsContext');\nlogger.setDebugTypeLogging('UserOrgsContext', false);\n\n/**\n * Session-restore retry backoff bounds (transient backend failures only).\n *\n * On RELOAD, a backend that is recompiling/restarting (dev) or briefly\n * unavailable (prod) makes the session-restore fetch fail transiently. Rather\n * than force a logout — which clears the shared `__wildo_refresh` cookie and\n * drops the user to the login screen — restore preserves the session and\n * retries with exponential backoff until the backend returns. Genuine auth/authz\n * and non-network errors do NOT retry (see `restoreSession`). Backoff caps so a\n * sustained outage settles at one attempt per {@link RESTORE_RETRY_MAX_DELAY_MS}.\n */\nconst RESTORE_RETRY_BASE_DELAY_MS = 1_000;\nconst RESTORE_RETRY_MAX_DELAY_MS = 30_000;\n\n/**\n * User Organizations Context\n * Manages user data, organizations, permissions, and preferences\n * Consumes AuthSessionContext for authentication state\n */\n\nexport interface UserOrgsContextType {\n  // Re-exported from AuthSession for backward compatibility\n  auth: ReturnType<typeof useAuthSession>['auth'];\n  identifyByEmail: ReturnType<typeof useAuthSession>['identifyByEmail'];\n  authenticateWithPassword: ReturnType<typeof useAuthSession>['authenticateWithPassword'];\n  authenticate: ReturnType<typeof useAuthSession>['authenticate'];\n  getSessionState: ReturnType<typeof useAuthSession>['getSessionState'];\n  isAuthenticated: ReturnType<typeof useAuthSession>['isAuthenticated'];\n  logout: () => void;\n  restoreSession: () => Promise<boolean>;\n\n  // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n  initiateOAuth2Login: ReturnType<typeof useAuthSession>['initiateOAuth2Login'];\n  handleAuthCodeExchange: ReturnType<typeof useAuthSession>['handleAuthCodeExchange'];\n\n  // User data\n  user: UserContext | null;\n\n  // Organization data\n  organizations: OrganizationContext[];\n  currentOrganizationId: string | null;\n  permissions: EffectivePermissions | null;\n  primaryScopeInitiatorIds: ExecutionContext_InitiatorIds | null;\n\n  // Privacy (only preference managed here, others are in their respective contexts)\n  privacy: UserPrivacy | null;\n\n  // Organization management\n  setCurrentOrganization: (organizationId: string) => void;\n  getCurrentOrganization: () => OrganizationContext | null;\n  refreshOrganizations: () => Promise<void>;\n\n  // Privacy getter\n  getPrivacy: () => UserPrivacy | null;\n}\n\n/**\n * UserOrgs Context\n * Exported for use in separate hook file (Fast Refresh compatibility)\n * @internal - Use useUserOrgs() hook instead of accessing this directly\n */\nexport const UserOrgsContext: React.Context<UserOrgsContextType | undefined> = createContext<UserOrgsContextType | undefined>(undefined);\n\nexport const UserOrgsProvider: React.FC<{ children: ReactNode }> = ({ children }) => {\n  const { doOperation, registry } = useResourceRegistry();\n  const { emit } = useEventBus();\n\n  // Consume auth session context\n  const authSession = useAuthSession();\n  const {\n    auth,\n    tokenStorage,\n    identifyByEmail,\n    authenticateWithPassword,\n    authenticate,\n    getSessionState,\n    isAuthenticated,\n    logout: authLogout,\n    initiateOAuth2Login,\n    handleAuthCodeExchange,\n    markSessionRestored,\n    setSessionRestoring,\n    connectWebSocket,\n  } = authSession;\n  const appScope = useAppScope();\n  const { commitOrganizationScopeValue } = useAppScopeInternal();\n  const currentOrganizationId = appScope.currentOrganizationId;\n\n  const hasInitializedRef = useRef(false);\n  const previousTokenRef = useRef<string | null>(null);\n  // Restore-retry lifecycle: `restoreAbortRef` flips true on unmount so an\n  // in-flight backoff loop bails instead of touching state on a dead component;\n  // `restoreRetryTimerRef` holds the pending backoff timer for cleanup.\n  const restoreAbortRef = useRef(false);\n  const restoreRetryTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);\n\n  const [user, setUser] = useState<UserContext | null>(null);\n\n  const [organizations, setOrganizations] = useState<OrganizationContext[]>([]);\n\n  const [permissions, setPermissions] = useState<{\n    appLevel: string[];\n    organizations: Record<string, string[]>;\n  } | null>(null);\n\n  const [privacy, setPrivacy] = useState<UserPrivacy | null>(null);\n\n  type PreferencesPayload = Pick<UserPreferences, 'languagePreferences' | 'regional' | 'ui' | 'notifications' | 'privacy'>;\n\n  /**\n   * The TENANT's half of the payload, derived from its preferences record rather than passed\n   * alongside it (#410).\n   *\n   * The organization contributes two things to `I18nContext` — its language policy and its regional\n   * defaults — and they are forwarded together because they come from one record. An earlier shape\n   * took the language block as its own argument, and when the regional half was added every call\n   * site would have had to remember to forward a second one: three sites, one obligation each, and\n   * a fourth site tomorrow that forwards neither. Passing the record makes forgetting impossible.\n   */\n  const organizationPreferencesPayload = (\n    organizationPreferences: OrganizationContext['preferences'] | null | undefined,\n  ): Record<string, unknown> => {\n    if (organizationPreferences === undefined) {\n      return {};\n    }\n    if (organizationPreferences === null) {\n      return { organizationLanguagePreferences: null, organizationRegionalPreferences: null };\n    }\n    return {\n      organizationLanguagePreferences: organizationPreferences.languagePreferences ?? null,\n      organizationRegionalPreferences: {\n        timezone: organizationPreferences.timezone,\n        locale: organizationPreferences.locale,\n        dateFormat: organizationPreferences.dateFormat,\n        timeFormat: organizationPreferences.timeFormat,\n      },\n    };\n  };\n\n  const emitPreferencesChanged = useCallback((\n    preferences: PreferencesPayload | null | undefined,\n    organizationPreferences?: OrganizationContext['preferences'] | null,\n  ): void => {\n    if (preferences === null) {\n      emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n        languagePreferences: null,\n        organizationLanguagePreferences: null,\n        regionalPreferences: null,\n        organizationRegionalPreferences: null,\n        notificationsPreferences: null,\n        uiPreferences: null,\n        privacy: null,\n      });\n      return;\n    }\n\n    emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n      ...(preferences?.languagePreferences !== undefined ? { languagePreferences: preferences.languagePreferences } : {}),\n      ...organizationPreferencesPayload(organizationPreferences),\n      ...(preferences?.regional !== undefined ? { regionalPreferences: preferences.regional } : {}),\n      ...(preferences?.notifications !== undefined ? { notificationsPreferences: preferences.notifications } : {}),\n      ...(preferences?.ui !== undefined ? { uiPreferences: preferences.ui } : {}),\n      ...(preferences?.privacy !== undefined ? { privacy: preferences.privacy } : {}),\n    });\n  }, [emit]);\n\n  const primaryScopeInitiatorIds = useMemo<ExecutionContext_InitiatorIds | null>(() => {\n    return ScopeUtilsService.buildInitiatorIds({\n      userId: appScope.currentUserId,\n      organizationId: appScope.currentOrganizationId,\n      applicationId: appScope.currentApplicationId,\n      anonymousUserId: appScope.currentAnonymousUserId,\n    });\n  }, [\n    appScope.currentApplicationId,\n    appScope.currentAnonymousUserId,\n    appScope.currentOrganizationId,\n    appScope.currentUserId,\n  ]);\n\n  /**\n   * Extract and store user preferences from context\n   * Stores preferences in state for other contexts to read and apply\n   */\n  const storePreferences = useCallback((\n    preferences: PreferencesPayload,\n    organizationPreferences?: OrganizationContext['preferences'] | null,\n  ): void => {\n    // Store privacy preferences in state\n    if (preferences.privacy) {\n      setPrivacy(preferences.privacy);\n    }\n\n    const currentOrganizationPreferences = organizationPreferences !== undefined\n      ? organizationPreferences\n      : currentOrganizationId\n        ? organizations.find((organization) => organization._id === currentOrganizationId)?.preferences\n        : undefined;\n\n    // Emit preference change event to notify parent contexts\n    emitPreferencesChanged(\n      preferences,\n      currentOrganizationPreferences,\n    );\n  }, [currentOrganizationId, emitPreferencesChanged, organizations]);\n\n  /**\n   * Compute effective permissions from user's app roles and organization roles\n   * This is a basic implementation - can be enhanced based on role hierarchy\n   */\n  const computeEffectivePermissions = (\n    userContext: UserContext,\n    organizationsList: OrganizationContext[]\n  ): EffectivePermissions | null => {\n    // App-level permissions from user's app roles\n    const appLevel = (userContext.appRoles || []) as string[];\n\n    // Per-organization permissions from organization membership roles\n    // Use new field name from relationship-based context\n    const organizationsPermissions: Record<string, string[]> = {};\n    const memberships = userContext.organizationMembers || [];\n\n    for (const membership of memberships) {\n      organizationsPermissions[membership.organizationId] = (membership.roles || []) as string[];\n    }\n\n    return {\n      appLevel,\n      organizations: organizationsPermissions,\n    };\n  };\n\n  /**\n   * Load organizations independently (can be called separately from authentication)\n   */\n  const loadOrganizations = useCallback(async (userContext: UserContext): Promise<{\n    organizationsList: OrganizationContext[];\n    selectedOrgId: string | null;\n  }> => {\n    const allMemberships = userContext.organizationMembers || [];\n\n    // W7.3b: For one-off sessions, restrict to the scoped organization only\n    const scopedOrgId = auth.sessionType === SessionType.ONE_OFF\n      ? tokenStorage.getOrganizationId()\n      : null;\n\n    const memberships = scopedOrgId\n      ? allMemberships.filter((m: any) => m.organizationId === scopedOrgId)\n      : allMemberships;\n\n    logDebug('Loading organizations', {\n      userId: userContext._id,\n      membershipCount: memberships.length,\n      isOneOff: auth.sessionType === SessionType.ONE_OFF,\n    });\n\n    const organizationsList: OrganizationContext[] = [];\n\n    if (memberships.length > 0) {\n      const organizationsConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];\n      if (!organizationsConfig) {\n        logger.warn('ORGANIZATIONS resource not available');\n        return { organizationsList, selectedOrgId: null };\n      }\n\n      const orgsReadOp = organizationsConfig.operations.find((op: any) =>\n        op.operationIdentifier === CoreResourceOperation.READ &&\n        op.isOperationDefault === true &&\n        op.isBulkOperation !== true &&\n        (\n          op.variantType === ResourceOperationVariantType.API_CALL ||\n          op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n        )\n      );\n\n      if (!orgsReadOp) {\n        logger.warn('ORGANIZATIONS READ operation not found');\n        return { organizationsList, selectedOrgId: null };\n      }\n\n      const organizationsOperationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(orgsReadOp);\n\n      /**\n       * The tenant's preference record is fetched SEPARATELY, and that is a decision rather than an\n       * omission (#563).\n       *\n       * `OrganizationContextSchema` declares `preferences`, and `doOperation<OrganizationContext>`\n       * is a CAST — nothing validates the response against it — so the field read as available\n       * while no producer existed: the ORGANIZATIONS **default** READ returns a plain\n       * `Organization`, and the organisation's regional block therefore never reached\n       * `I18nContext`. Every date and number in every generated application formatted at the\n       * framework floor as a result.\n       *\n       * The rejected alternative was to switch this call to the ORGANIZATIONS **context** variant,\n       * which does populate the child. Measured against the running stack on 2026-09-10, that\n       * response carries every context-enabled child of an organisation — `auditLogs`, `todos`,\n       * `tasks`, `knowledgeDocuments`, `organizationMembers`, … — so session restore would pull an\n       * unbounded page of tenant data per membership to obtain four regional fields. The\n       * preference record has its own default READ (`GET /organizations/{id}/organization-preference`,\n       * reachable by an ordinary `ORG_MEMBER`), which is one small request with a stable shape.\n       *\n       * Best-effort by construction: a tenant whose preferences cannot be read still yields a\n       * usable organisation, and `organizationPreferencesPayload(undefined)` then contributes\n       * nothing to the i18n event rather than clearing the member's own settings.\n       */\n      const organizationPreferencesConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES];\n      const organizationPreferencesReadOp = organizationPreferencesConfig?.operations?.find((op: any) =>\n        op.operationIdentifier === CoreResourceOperation.READ &&\n        op.isOperationDefault === true &&\n        op.isBulkOperation !== true &&\n        (\n          op.variantType === ResourceOperationVariantType.API_CALL ||\n          op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n        )\n      );\n\n      if (!organizationPreferencesReadOp) {\n        logger.warn('ORGANIZATION_PREFERENCES READ operation not found — tenant regional defaults will not be applied');\n      }\n\n      const organizationPreferencesOperationPath = organizationPreferencesReadOp\n        ? ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(organizationPreferencesReadOp)\n        : null;\n\n      const fetchOrganizationPreferences = async (\n        organizationId: string,\n      ): Promise<OrganizationContext['preferences'] | undefined> => {\n        if (!organizationPreferencesOperationPath) return undefined;\n        try {\n          return await doOperation<NonNullable<OrganizationContext['preferences']>>(\n            organizationPreferencesOperationPath,\n            { contextualParameters: { organizationId } },\n          ) ?? undefined;\n        } catch (error) {\n          logger.warn('Failed to fetch organization preferences', { organizationId, error });\n          return undefined;\n        }\n      };\n\n      const orgPromises = memberships.map(async (membership: any) => {\n        try {\n          const [org, preferences] = await Promise.all([\n            doOperation<OrganizationContext>(\n              organizationsOperationPath,\n              { contextualParameters: { organizationId: membership.organizationId } }),\n            fetchOrganizationPreferences(membership.organizationId),\n          ]);\n\n          if (!org) return null;\n          // OMIT the key when the read failed rather than attaching `null`. The payload builder\n          // reads the two differently: `undefined`/absent contributes nothing to the i18n event,\n          // while `null` means \"the tenant has cleared its preferences\" and actively resets the\n          // organisation half — which would silently downgrade a member to the framework floor\n          // because one request failed.\n          return preferences ? { ...org, preferences } : org;\n        } catch (error) {\n          logger.warn('Failed to fetch organization', { organizationId: membership.organizationId, error });\n          return null;\n        }\n      });\n\n      const orgResults = await Promise.all(orgPromises);\n      organizationsList.push(...orgResults.filter((org): org is OrganizationContext => org !== null));\n    }\n\n    // Restore current organization selection\n    const storedOrgId = tokenStorage.getOrganizationId();\n    const selectedOrgId = storedOrgId && organizationsList.find(o => o._id === storedOrgId)\n      ? storedOrgId\n      : organizationsList[0]?._id || null;\n\n    // Compute effective permissions from roles\n    const computedPermissions = computeEffectivePermissions(userContext, organizationsList);\n\n    setOrganizations(organizationsList);\n    commitOrganizationScopeValue(selectedOrgId);\n    setPermissions(computedPermissions);\n\n    logDebug('Organizations loaded', { organizationCount: organizationsList.length, currentOrganizationId: selectedOrgId });\n    return { organizationsList, selectedOrgId };\n  }, [commitOrganizationScopeValue, doOperation, registry, tokenStorage, auth.sessionType]);\n\n  /**\n   * Restore regular user session\n   */\n  const restoreUserSession = useCallback(async (accessToken: string): Promise<boolean> => {\n    logDebug('Restoring user session');\n\n    // Check if USER_SELF is available\n    const availableResources = Object.keys(registry.resourceConfigurations);\n    const hasUserSelf = availableResources.includes(CoreResourceType.USER_SELF);\n\n    if (!hasUserSelf) {\n      logger.warn('USER_SELF resource not available for session restoration');\n      return false;\n    }\n\n    // Get USER_SELF resource config\n    const userSelfConfig = registry.resourceConfigurations[CoreResourceType.USER_SELF];\n\n    const readOperation = userSelfConfig?.operations?.find((op: any) =>\n      op.operationIdentifier === CoreResourceOperation.READ &&\n      op.isOperationDefault === true &&\n      op.isBulkOperation !== true &&\n      (\n        op.variantType === ResourceOperationVariantType.API_CALL ||\n        op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n      )\n    );\n\n    if (!readOperation) {\n      logger.warn('USER_SELF READ operation not found');\n      return false;\n    }\n\n    // Find context variant (auto-generated with relationship population)\n    const readContextOp = userSelfConfig.operations.find((op: any) =>\n      op.operationIdentifier === CoreResourceOperation.READ &&\n      op.isBulkOperation !== true &&\n      (\n        op.variantType === ResourceOperationVariantType.API_CALL ||\n        op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n      ) &&\n      op.variantKey === OPERATION_VARIANT_KEY.CONTEXT\n    );\n\n    if (!readContextOp) {\n      logger.warn('USER_SELF context variant not found');\n      return false;\n    }\n\n    const initiatorInfo = readOperation.initiatorInfos?.[0];\n    const requiresUserId = initiatorInfo?.parameters?.some((p: any) => p.fieldIdentifier === 'userId');\n\n    const contextualParameters: Record<string, string> = {};\n\n    if (requiresUserId && accessToken) {\n      try {\n        const payload = decodeJwtPayload<{ userId?: string }>(accessToken);\n        if (payload.userId) {\n          contextualParameters.userId = payload.userId;\n        }\n      } catch (e) {\n        logDebug('Failed to decode JWT for userId extraction', { error: e });\n      }\n    }\n\n    // Build operation path and fetch user context\n    const contextPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readContextOp);\n    const userContext = await doOperation<UserContext>(contextPath, { contextualParameters });\n\n    if (!userContext) {\n      logger.warn('Failed to fetch user context during session restoration');\n      return false;\n    }\n\n    // Use new field name from relationship-based context\n    const membershipsCount = (userContext.organizationMembers || []).length;\n    logDebug('User context restored', { userId: userContext._id, organizationCount: membershipsCount });\n\n    // Update user state\n    setUser(userContext);\n\n    // Load organizations separately\n    // If this fails, session restoration still succeeds (user context is restored)\n    const { organizationsList, selectedOrgId } = await loadOrganizations(userContext);\n\n    // Store preferences after organization loading so i18n receives user and\n    // active-organization language policy in the same event.\n    const preferences = userContext.userSelfPreferences;\n    if (preferences) {\n      const currentOrganization = selectedOrgId\n        ? organizationsList.find((organization) => organization._id === selectedOrgId)\n        : null;\n      storePreferences(preferences, currentOrganization?.preferences);\n    }\n\n    logger.info('Session restored successfully', {\n      userId: userContext._id,\n      organizationCount: membershipsCount\n    });\n\n    return true;\n  }, [doOperation, registry, loadOrganizations, storePreferences]);\n\n  // Stop any pending restore-retry backoff when the provider unmounts, so the\n  // loop in `restoreSession` bails instead of calling setState on a dead tree.\n  useEffect(() => {\n    restoreAbortRef.current = false;\n    return () => {\n      restoreAbortRef.current = true;\n      if (restoreRetryTimerRef.current) {\n        clearTimeout(restoreRetryTimerRef.current);\n        restoreRetryTimerRef.current = null;\n      }\n    };\n  }, []);\n\n  /**\n   * Restore session from stored JWT token\n   * Fetches user context using USER_SELF resource (userId comes from JWT)\n   * Then fetches full organization details for each organization membership\n   *\n   * Resilience: a TRANSIENT backend failure (unreachable / 5xx / timeout, or a\n   * 401 whose in-flight renewal failed transiently) does NOT log out — restore\n   * preserves the session and retries with capped exponential backoff until the\n   * backend returns. Genuine authentication (401), authorization (403), and\n   * non-network errors terminate immediately (no retry on a dead-or-buggy path).\n   */\n  const restoreSession = useCallback(async (): Promise<boolean> => {\n    logDebug('Restoring session from stored token');\n\n    // Check if session is already restored to avoid duplicate restoration attempts\n    if (auth.sessionRestored && auth.accessToken && user) {\n      logDebug('Session already restored, skipping restoration');\n      return true;\n    }\n\n    // Read token from auth state\n    const accessToken = auth.accessToken;\n\n    if (!accessToken) {\n      logDebug('No access token available');\n      return false;\n    }\n\n    setSessionRestoring(true);\n\n    let attempt = 0;\n    // Single backoff loop: the invoking effect won't re-enter while\n    // `isRestoringSession` is true, so this is the sole restore in flight.\n    while (true) {\n      try {\n        const restored = await restoreUserSession(accessToken);\n\n        if (restored) {\n          markSessionRestored();\n\n          // W7.3b: One-off sessions already connected WebSocket in handleOneOffTokenExchange\n          // (with consumableToken). Reconnecting here would lose the consumable token.\n          if (auth.sessionType !== SessionType.ONE_OFF) {\n            // Connect with the FRESHEST token, read live from storage — NOT the\n            // `accessToken` captured at the top of `restoreSession`. During the\n            // awaited `restoreUserSession` above, the HTTP interceptor may have\n            // hit a `401 OUTDATED_AUTH_JWT` and rotated the token via\n            // `tokenRenewalHandler` (which writes the new token to storage AND\n            // seeds the WS `authStateRef` synchronously). The captured\n            // `accessToken` is then stale/expired; passing it into `connect()`\n            // reseeds the WS credential source-of-truth back to the expired token\n            // (clobbering the fresh one the refresh just stored), and the Socket.IO\n            // handshake gets rejected with \"Authentication failed\". `getAccessToken()`\n            // returns the live, post-refresh value (falling back to the captured\n            // token only if storage is somehow empty).\n            const freshestAccessToken = tokenStorage.getAccessToken() ?? accessToken;\n            connectWebSocket(freshestAccessToken, tokenStorage.getOrganizationId());\n          }\n        } else {\n          logger.warn('Session restoration could not build a valid authenticated context; logging out to avoid a half-restored state');\n          authLogout();\n        }\n\n        return restored;\n\n      } catch (error: any) {\n        // Authorization (403 / scope) is checked FIRST and is non-destructive: a\n        // permission denial must NEVER destroy a valid session. Authentication\n        // (401 / session-invalid) is the only branch that force-logs-out.\n        // `isAuthenticationError` already excludes authorization errors (see\n        // `AuthSessionUtils`), so these are mutually exclusive — the explicit\n        // ordering here is defense-in-depth so the non-destructive path wins even\n        // if that guard is ever loosened.\n        const isAuthorizationError = AuthSessionUtils.isAuthorizationError(error);\n\n        if (isAuthorizationError) {\n          const errorMessage = error?.message || 'Session restoration blocked by authorization';\n          logger.warn('Session restoration encountered authorization/scope error', {\n            error: errorMessage,\n            errorType: error?.wildoError?.type || error?.response?.data?.error?.type,\n            status: error?.response?.status,\n          });\n          setSessionRestoring(false);\n          markSessionRestored();\n          return false;\n        }\n\n        // TRANSIENT backend failure (checked BEFORE the authentication branch so\n        // a 401 whose renewal failed transiently is retried, not logged out):\n        // preserve the session, back off, and retry. Bail if the component\n        // unmounted or the session was cleared (logout elsewhere) while waiting.\n        if (isTransientBackendFailure(error)) {\n          attempt += 1;\n          const delay = Math.min(\n            RESTORE_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1),\n            RESTORE_RETRY_MAX_DELAY_MS,\n          );\n          logger.warn('Session restoration hit a transient backend failure; preserving session and retrying', {\n            attempt,\n            retryInMs: delay,\n            status: error?.response?.status,\n            code: error?.code,\n          });\n          await new Promise<void>((resolve) => {\n            restoreRetryTimerRef.current = setTimeout(resolve, delay);\n          });\n          if (restoreAbortRef.current || !tokenStorage.getAccessToken()) {\n            setSessionRestoring(false);\n            return false;\n          }\n          continue;\n        }\n\n        if (AuthSessionUtils.isAuthenticationError(error)) {\n          logDebug('Session restoration failed due to authentication error', {\n            errorType: error?.wildoError?.type || error?.response?.data?.error?.type,\n            status: error?.response?.status,\n          });\n          authLogout();\n          return false;\n        }\n\n        // Fail closed on unexpected NON-transient errors. A partially restored\n        // authenticated shell is less safe than dropping back to a clean login.\n        const errorMessage = error?.message || 'Session restoration failed';\n        logger.warn('Session restoration encountered a non-transient error; logging out', {\n          error: errorMessage,\n          errorType: error?.wildoError?.type,\n        });\n\n        authLogout();\n        return false;\n      }\n    }\n  }, [\n    restoreUserSession,\n    auth.sessionRestored,\n    auth.sessionType,\n    auth.accessToken,\n    user,\n    authLogout,\n    markSessionRestored,\n    setSessionRestoring,\n    connectWebSocket,\n    tokenStorage\n  ]);\n\n  /**\n   * Refresh organizations data (e.g., after organization update)\n   */\n  const refreshOrganizations = useCallback(async (): Promise<void> => {\n    // Use new field name from relationship-based context\n    const memberships = user?.organizationMembers || [];\n\n    if (memberships.length === 0) {\n      logDebug('No organizations membership to refresh');\n      return;\n    }\n\n    logDebug('Refreshing organizations', { membershipCount: memberships.length });\n\n    // Use loadOrganizations to refresh\n    await loadOrganizations(user!);\n  }, [user, loadOrganizations]);\n\n  useEffect(() => {\n    if (!user?.userSelfPreferences) {\n      return;\n    }\n\n    const currentOrganization = currentOrganizationId\n      ? organizations.find((organization) => organization._id === currentOrganizationId)\n      : null;\n\n    emitPreferencesChanged(\n      user.userSelfPreferences,\n      currentOrganization?.preferences,\n    );\n  }, [currentOrganizationId, emitPreferencesChanged, organizations, user]);\n\n  /**\n   * Set the current active organization\n   */\n  const setCurrentOrganization = useCallback((organizationId: string): void => {\n    // Validate that organization exists in user's organizations\n    const org = organizations.find(o => o._id === organizationId);\n    if (!org) {\n      logger.warn('Attempted to set invalid organization', { organizationId, availableOrganizations: organizations.map(o => o._id) });\n      return;\n    }\n\n    const previousOrganizationId = currentOrganizationId;\n\n    // Skip if the organization hasn't changed\n    if (previousOrganizationId === organizationId) {\n      return;\n    }\n\n    logDebug('Setting current organization', { organizationId, organizationName: org.name, previousOrganizationId });\n    commitOrganizationScopeValue(organizationId);\n  }, [organizations, currentOrganizationId, commitOrganizationScopeValue]);\n\n  /**\n   * Get the current active organization\n   */\n  const getCurrentOrganization = useCallback((): OrganizationContext | null => {\n    if (!currentOrganizationId) {\n      return null;\n    }\n    return organizations.find(o => o._id === currentOrganizationId) || null;\n  }, [currentOrganizationId, organizations]);\n\n  /**\n   * Get privacy preferences\n   */\n  const getPrivacy = useCallback((): UserPrivacy | null => {\n    return privacy;\n  }, [privacy]);\n\n  /**\n   * Logout wrapper that also clears user/org data\n   */\n  const logout = useCallback((): void => {\n    logDebug('Logging out user', { userId: user?._id, organizationId: currentOrganizationId });\n\n    // Clear user/org data first\n    setUser(null);\n    setOrganizations([]);\n    commitOrganizationScopeValue(null);\n    setPermissions(null);\n    setPrivacy(null);\n    emitPreferencesChanged(null);\n\n    // Reset initialization flag\n    hasInitializedRef.current = false;\n    previousTokenRef.current = null;\n\n    // Call auth logout (clears tokens, disconnects WebSocket)\n    authLogout();\n  }, [user?._id, currentOrganizationId, authLogout, commitOrganizationScopeValue, emitPreferencesChanged]);\n\n  // Auto-load user/org data when token becomes available\n  useEffect(() => {\n    const accessToken = auth.accessToken;\n\n    // Skip if no token or token hasn't changed\n    if (!accessToken || accessToken === previousTokenRef.current) {\n      return;\n    }\n\n    // Skip if session is already restored with this token\n    if (auth.sessionRestored && user) {\n      previousTokenRef.current = accessToken;\n      return;\n    }\n\n    // Skip if already initializing\n    if (hasInitializedRef.current && auth.isRestoringSession) {\n      return;\n    }\n\n    logDebug('Token changed, initiating session restoration', {\n      hasToken: !!accessToken,\n      previousToken: !!previousTokenRef.current\n    });\n\n    previousTokenRef.current = accessToken;\n    hasInitializedRef.current = true;\n\n    // Restore session (will fetch user/org data)\n    restoreSession().catch((error) => {\n      logger.error('Session restoration failed', { error });\n    });\n  }, [auth.accessToken, auth.sessionRestored, auth.isRestoringSession, user, restoreSession]);\n\n  // Clear data when token is removed (logged out)\n  useEffect(() => {\n    if (!auth.accessToken && previousTokenRef.current) {\n      logDebug('Token removed, clearing user/org data');\n      setUser(null);\n      setOrganizations([]);\n      commitOrganizationScopeValue(null);\n      setPermissions(null);\n      setPrivacy(null);\n      emitPreferencesChanged(null);\n      previousTokenRef.current = null;\n      hasInitializedRef.current = false;\n    }\n  }, [auth.accessToken, commitOrganizationScopeValue, emitPreferencesChanged]);\n\n  const value = useMemo<UserOrgsContextType>(() => ({\n    // Re-exported from AuthSession for backward compatibility\n    auth,\n    identifyByEmail,\n    authenticateWithPassword,\n    authenticate,\n    getSessionState,\n    isAuthenticated,\n    logout,\n    restoreSession,\n\n    // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n    initiateOAuth2Login,\n    handleAuthCodeExchange,\n\n    // User data\n    user,\n\n    // Organization data\n    organizations,\n    currentOrganizationId,\n    permissions,\n    primaryScopeInitiatorIds,\n\n    // Privacy (only preference managed here)\n    privacy,\n\n    // Organization management\n    setCurrentOrganization,\n    getCurrentOrganization,\n    refreshOrganizations,\n\n    // Privacy getter\n    getPrivacy,\n  }), [\n    auth,\n    identifyByEmail,\n    authenticateWithPassword,\n    authenticate,\n    getSessionState,\n    isAuthenticated,\n    logout,\n    restoreSession,\n    initiateOAuth2Login,\n    handleAuthCodeExchange,\n    user,\n    organizations,\n    currentOrganizationId,\n    permissions,\n    primaryScopeInitiatorIds,\n    privacy,\n    setCurrentOrganization,\n    getCurrentOrganization,\n    refreshOrganizations,\n    getPrivacy,\n  ]);\n\n  return <UserOrgsContext.Provider value={value}>{children}</UserOrgsContext.Provider>;\n};\n\n// useUserOrgs hook is now in separate file: ./useUserOrgs.ts\n// This separation is required for React Fast Refresh compatibility\n"]}

package/dist/esm/core/security/auth-redirect.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-redirect.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,yBAAyB,aAAa,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,IAAI,MAAM,CAE5F;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAET;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACxC,MAAM,CAYR;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,MAA8B,GAC3C,MAAM,CAER"}
+{"version":3,"file":"auth-redirect.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,yBAAyB,aAAa,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,IAAI,MAAM,CAE5F;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAET;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACxC,MAAM,CAYR;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,MAA8B,GAC3C,MAAM,CAER"}

package/dist/esm/core/security/auth-redirect.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-redirect.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAEhG,MAAM,CAAC,MAAM,yBAAyB,GAAG,UAAU,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAiC;IACxE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAIvC;IACC,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IAChD,YAAY,CAAC,GAAG,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC1C,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAEnE,OAAO,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,eAAuB,gBAAgB,CAAC,IAAI;IAE5C,OAAO,6BAA6B,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC;AAC/D,CAAC","sourcesContent":["import { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\n\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\n\nexport const AUTH_REDIRECT_QUERY_PARAM = 'redirect';\n\n/**\n * Is this a redirect target the app may navigate to after authentication?\n *\n * ## Why this delegates instead of testing prefixes\n *\n * The previous implementation was `target.startsWith('/') && !target.startsWith('//')`, and it is\n * worth writing down why that is not a weaker version of the check but a broken one: it tests the\n * bytes a human reads, while the browser navigates to what its URL PARSER produces, and the two\n * disagree on a whole family of inputs. SEVEN shapes passed it and resolved to `https://evil.com/` —\n * `/\\evil.com`, `/\\\\evil.com`, `/\\/evil.com`, and the tab / LF / CR variants that the parser strips\n * before parsing. The measurement and the two parser rules behind it are documented once, at\n * {@link isSameOriginRedirectPath}.\n *\n * The exploit is post-authentication, which is what makes it worth more than an ordinary open\n * redirect: the user has just proved who they are to a site they trust, and the app hands them to the\n * attacker's origin carrying that established trust.\n *\n * ## Why the predicate is imported rather than written here\n *\n * Three other surfaces answer the same question — the one-off-session receiver, the docs-site auth\n * exchange page, and the issuer/receiver schemas in `saas-models` — and on 2026-08-15 all four\n * carried the same hole, because each was a separately hand-written deny-list that \"mirrored\" the\n * others. One importable predicate is what stops the fifth copy from being written.\n */\nexport function isSafeAuthRedirectTarget(target: string | null | undefined): target is string {\n  return isSameOriginRedirectPath(target);\n}\n\nexport function buildAuthRedirectTarget(params: {\n  pathname: string;\n  search?: string;\n  hash?: string;\n}): string {\n  return `${params.pathname}${params.search ?? ''}${params.hash ?? ''}`;\n}\n\nexport function appendAuthRedirectToPath(\n  basePath: string,\n  redirectTarget: string | null | undefined,\n): string {\n  if (!isSafeAuthRedirectTarget(redirectTarget)) {\n    return basePath;\n  }\n\n  const [pathAndQuery, hash = ''] = basePath.split('#');\n  const [pathname, query = ''] = pathAndQuery.split('?');\n  const searchParams = new URLSearchParams(query);\n  searchParams.set(AUTH_REDIRECT_QUERY_PARAM, redirectTarget);\n\n  const nextQuery = searchParams.toString();\n  return `${pathname}${nextQuery ? `?${nextQuery}` : ''}${hash ? `#${hash}` : ''}`;\n}\n\nexport function extractAuthRedirectFromSearch(search: string): string | undefined {\n  const searchParams = new URLSearchParams(search);\n  const redirectTarget = searchParams.get(AUTH_REDIRECT_QUERY_PARAM);\n\n  return isSafeAuthRedirectTarget(redirectTarget) ? redirectTarget : undefined;\n}\n\nexport function resolvePostAuthRedirect(\n  search: string,\n  fallbackPath: string = CommonRoutePaths.home,\n): string {\n  return extractAuthRedirectFromSearch(search) ?? fallbackPath;\n}\n"]}
+{"version":3,"file":"auth-redirect.frontend.utils.js","sourceRoot":"","sources":["../../../../src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAEhG,MAAM,CAAC,MAAM,yBAAyB,GAAG,UAAU,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAiC;IACxE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAIvC;IACC,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IAChD,YAAY,CAAC,GAAG,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC1C,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAEnE,OAAO,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,eAAuB,gBAAgB,CAAC,IAAI;IAE5C,OAAO,6BAA6B,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC;AAC/D,CAAC","sourcesContent":["import { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\n\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\n\nexport const AUTH_REDIRECT_QUERY_PARAM = 'redirect';\n\n/**\n * Is this a redirect target the app may navigate to after authentication?\n *\n * ## Why this delegates instead of testing prefixes\n *\n * The previous implementation was `target.startsWith('/') && !target.startsWith('//')`, and it is\n * worth writing down why that is not a weaker version of the check but a broken one: it tests the\n * bytes a human reads, while the browser navigates to what its URL PARSER produces, and the two\n * disagree on a whole family of inputs. SEVEN shapes passed it and resolved to `https://evil.com/` —\n * `/\\evil.com`, `/\\\\evil.com`, `/\\/evil.com`, and the tab / LF / CR variants that the parser strips\n * before parsing. The measurement and the two parser rules behind it are documented once, at\n * {@link isSameOriginRedirectPath}.\n *\n * The exploit is post-authentication, which is what makes it worth more than an ordinary open\n * redirect: the user has just proved who they are to a site they trust, and the app hands them to the\n * attacker's origin carrying that established trust.\n *\n * ## Why the predicate is imported rather than written here\n *\n * Three other surfaces answer the same question — the one-off-session receiver, the docs-site auth\n * exchange page, and the issuer/receiver schemas in `saas-models` — and on 2026-08-15 all four\n * carried the same hole, because each was a separately hand-written deny-list that \"mirrored\" the\n * others. One importable predicate is what stops the fifth copy from being written.\n */\nexport function isSafeAuthRedirectTarget(target: string | null | undefined): target is string {\n  return isSameOriginRedirectPath(target);\n}\n\nexport function buildAuthRedirectTarget(params: {\n  pathname: string;\n  search?: string;\n  hash?: string;\n}): string {\n  return `${params.pathname}${params.search ?? ''}${params.hash ?? ''}`;\n}\n\nexport function appendAuthRedirectToPath(\n  basePath: string,\n  redirectTarget: string | null | undefined,\n): string {\n  if (!isSafeAuthRedirectTarget(redirectTarget)) {\n    return basePath;\n  }\n\n  const [pathAndQuery, hash = ''] = basePath.split('#');\n  const [pathname, query = ''] = pathAndQuery.split('?');\n  const searchParams = new URLSearchParams(query);\n  searchParams.set(AUTH_REDIRECT_QUERY_PARAM, redirectTarget);\n\n  const nextQuery = searchParams.toString();\n  return `${pathname}${nextQuery ? `?${nextQuery}` : ''}${hash ? `#${hash}` : ''}`;\n}\n\nexport function extractAuthRedirectFromSearch(search: string): string | undefined {\n  const searchParams = new URLSearchParams(search);\n  const redirectTarget = searchParams.get(AUTH_REDIRECT_QUERY_PARAM);\n\n  return isSafeAuthRedirectTarget(redirectTarget) ? redirectTarget : undefined;\n}\n\nexport function resolvePostAuthRedirect(\n  search: string,\n  fallbackPath: string = CommonRoutePaths.home,\n): string {\n  return extractAuthRedirectFromSearch(search) ?? fallbackPath;\n}\n"]}

package/dist/esm/core/security/auth-session.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-session.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/auth-session.utils.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,eAAe,EAAE,UAAU,EAAE,CAAC;IAC9B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAkBD;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO;IAEP;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAuCjD;;;OAGG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAiBhD;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAChC,WAAW,EAAE,OAAO,EACpB,mBAAmB,EAAE,UAAU,EAAE,EACjC,2BAA2B,EAAE,UAAU,EAAE,EACzC,oBAAoB,EAAE,UAAU,EAAE,GACjC,yBAAyB;CAyC7B"}
+{"version":3,"file":"auth-session.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/security/auth-session.utils.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,eAAe,EAAE,UAAU,EAAE,CAAC;IAC9B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAkBD;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO;IAEP;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAuCjD;;;OAGG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAiBhD;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAChC,WAAW,EAAE,OAAO,EACpB,mBAAmB,EAAE,UAAU,EAAE,EACjC,2BAA2B,EAAE,UAAU,EAAE,EACzC,oBAAoB,EAAE,UAAU,EAAE,GACjC,yBAAyB;CAyC7B"}

package/dist/esm/core/security/auth-session.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-session.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/auth-session.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAuB,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAUzF,MAAM,+BAA+B,GAA2C;IAC9E,2BAA2B,CAAC,cAAc;IAC1C,2BAA2B,CAAC,iBAAiB;IAC7C,2BAA2B,CAAC,iBAAiB;IAC7C,2BAA2B,CAAC,mBAAmB;IAC/C,2BAA2B,CAAC,sBAAsB;IAClD,2BAA2B,CAAC,4BAA4B;IACxD,2BAA2B,CAAC,+BAA+B;IAC3D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,kCAAkC;IAC9D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,6BAA6B;IACzD,2BAA2B,CAAC,yCAAyC;CAC7D,CAAC;AAEX;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAC3B,gBAAuB,CAAC;IAExB;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAU;QACrC,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,EAAE,UAA6C,CAAC;QACxE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;gBACtC,IAAI,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,sBAAqD,CAAC,EAAE,CAAC;oBAC/G,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrC,IAAI,MAAM,KAAK,cAAc,CAAC,YAAY,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAC5C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;gBACnB,IAAI,+BAA+B,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAmC,CAAC,EAAE,CAAC;oBAC5F,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAU;QACpC,MAAM,UAAU,GAAG,KAAK,EAAE,UAA6C,CAAC;QACxE,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,cAAc,CAAC,SAAS,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAChC,WAAoB,EACpB,mBAAiC,EACjC,2BAAyC,EACzC,oBAAkC;QAElC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,EAAE;gBAClB,eAAe,EAAE,2BAA2B;gBAC5C,kBAAkB,EAAE,KAAK;aAC1B,CAAC;QACJ,CAAC;QAED,iFAAiF;QACjF,EAAE;QACF,mGAAmG;QACnG,mGAAmG;QACnG,0GAA0G;QAC1G,sGAAsG;QACtG,wGAAwG;QACxG,yGAAyG;QACzG,qGAAqG;QACrG,kCAAkC;QAClC,EAAE;QACF,sGAAsG;QACtG,oGAAoG;QACpG,gGAAgG;QAChG,qBAAqB;QACrB,MAAM,aAAa,GAAiB,oBAAoB,CAAC,MAAM,GAAG,CAAC;YACjE,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/E,CAAC,CAAC,mBAAmB,CAAC;QAExB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzD,MAAM,uBAAuB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5E,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtE,OAAO;YACL,UAAU,EAAE,uBAAuB;YACnC,cAAc;YACd,eAAe,EAAE,2BAA2B;YAC5C,kBAAkB,EAAE,CAAC,uBAAuB;SAC7C,CAAC;IACJ,CAAC;CACF","sourcesContent":["import {\n  ErrorType,\n  HttpStatusCode,\n} from '@wildo-ai/saas-models';\nimport { WildoError_Frontend, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\nimport type { AuthMethod } from '@wildo-ai/saas-models';\n\nexport interface AccountCompletenessResult {\n  isComplete: boolean;\n  missingMethods: AuthMethod[];\n  enrolledMethods: AuthMethod[];\n  requiresEnrollment: boolean;\n}\n\nconst AUTHENTICATION_ERROR_REFERENCES: readonly ErrorCustomMessageReference[] = [\n  ErrorCustomMessageReference.AUTHENTICATION,\n  ErrorCustomMessageReference.JWT_TOKEN_EXPIRED,\n  ErrorCustomMessageReference.JWT_TOKEN_INVALID,\n  ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n  ErrorCustomMessageReference.JWT_TOKEN_NOT_VERIFIED,\n  ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n  ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n  ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n  ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED,\n  ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_AUTHORIZED,\n  ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n  ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n  ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n] as const;\n\n/**\n * Static utility class for authentication/session non-component logic.\n */\nexport class AuthSessionUtils {\n  private constructor() {}\n\n  /**\n   * Check if an error is an AUTHENTICATION (session-invalid) error — i.e. the\n   * caller's session/token is missing, expired, or invalid and they must\n   * re-authenticate. This drives the session-restore force-logout, so a false\n   * positive here logs a perfectly valid session out.\n   *\n   * Authentication (401 / session-invalid) and AUTHORIZATION (403 / scope /\n   * permission) are DISTINCT axes and are mutually exclusive: a permission\n   * denial is NOT a reason to destroy the session. We therefore short-circuit\n   * to `false` for any authorization error BEFORE the reference-list check\n   * below — this neutralizes `AUTHENTICATION_USER_NOT_AUTHORIZED`, which is\n   * semantically an authorization concept that merely lives in the\n   * authentication-namespaced `ErrorCustomMessageReference` enum. When it\n   * arrives as a 403 (the realistic case) it is an authorization error, full\n   * stop, and must not log the user out (recovered 2026-06-29: the\n   * session-restore path over-logged-out on scope errors carrying this ref).\n   */\n  static isAuthenticationError(error: any): boolean {\n    if (AuthSessionUtils.isAuthorizationError(error)) {\n      return false;\n    }\n\n    const wildoError = error?.wildoError as WildoError_Frontend | undefined;\n    if (wildoError) {\n      if (wildoError.type === ErrorType.AUTHENTICATION) {\n        return true;\n      }\n      if (wildoError.customMessageReference) {\n        if (AUTHENTICATION_ERROR_REFERENCES.includes(wildoError.customMessageReference as ErrorCustomMessageReference)) {\n          return true;\n        }\n      }\n    }\n\n    if (error?.response?.status) {\n      const status = error.response.status;\n      if (status === HttpStatusCode.UNAUTHORIZED) {\n        return true;\n      }\n    }\n\n    if (error?.response?.data?.error) {\n      const errorData = error.response.data.error;\n      if (errorData.type === ErrorType.AUTHENTICATION) {\n        return true;\n      }\n      if (errorData.code) {\n        if (AUTHENTICATION_ERROR_REFERENCES.includes(errorData.code as ErrorCustomMessageReference)) {\n          return true;\n        }\n      }\n    }\n\n    return false;\n  }\n\n  /**\n   * Check whether an error represents an authorization/scope problem rather than an\n   * invalid or expired authentication session.\n   */\n  static isAuthorizationError(error: any): boolean {\n    const wildoError = error?.wildoError as WildoError_Frontend | undefined;\n    if (wildoError?.type === ErrorType.AUTHORIZATION) {\n      return true;\n    }\n\n    if (error?.response?.status === HttpStatusCode.FORBIDDEN) {\n      return true;\n    }\n\n    if (error?.response?.data?.error?.type === ErrorType.AUTHORIZATION) {\n      return true;\n    }\n\n    return false;\n  }\n\n  /**\n   * D7: Frontend-only computation. Evaluates whether the user has enrolled sufficient\n   * second-factor methods to satisfy the MFA policy.\n   *\n   * @param requiresMFA - Backend-computed flag incorporating app-level + org-level policy\n   * @param availableMFAMethods - Policy-filtered methods from the auth response\n   * @param enrolledSecondFactorMethods - Methods the user has already enrolled\n   * @param acceptableMFAMethods - App-config `mfaPolicy.acceptableMFAMethods` (may be empty)\n   */\n  static evaluateAccountCompleteness(\n    requiresMFA: boolean,\n    availableMFAMethods: AuthMethod[],\n    enrolledSecondFactorMethods: AuthMethod[],\n    acceptableMFAMethods: AuthMethod[],\n  ): AccountCompletenessResult {\n    if (!requiresMFA) {\n      return {\n        isComplete: true,\n        missingMethods: [],\n        enrolledMethods: enrolledSecondFactorMethods,\n        requiresEnrollment: false,\n      };\n    }\n\n    // `acceptableMFAMethods` NARROWS the policy-derived list — it never replaces it.\n    //\n    // This mirrors the backend, where `_getAvailableSecondFactorMethods` seeds its candidates from the\n    // intrinsic factor map and applies `acceptableMFAMethods` as a FILTER, so app config can only ever\n    // subtract methods. Resolving it as a REPLACEMENT here (`acceptable.length > 0 ? acceptable : available`)\n    // widened the set back out to raw config, which could name methods that are impossible for this user:\n    // an SSO redirect flow (intrinsically FIRST_ONLY — never an MFA ceremony, B-SEC-1) or a method disabled\n    // for their user type. `isComplete` was never wrong — it requires an ENROLLED method to match, and those\n    // are never enrolled — but `missingMethods` was, so the enrollment UI could instruct a user to enrol\n    // something they can never enrol.\n    //\n    // An EMPTY intersection is honest, not a regression: it means the policy admits no second factor this\n    // user could satisfy, which the startup config validator now rejects outright as a deadlock — so it\n    // cannot reach production, and surfacing \"enrollment required, nothing offered\" beats naming an\n    // impossible method.\n    const acceptableSet: AuthMethod[] = acceptableMFAMethods.length > 0\n      ? availableMFAMethods.filter((method) => acceptableMFAMethods.includes(method))\n      : availableMFAMethods;\n\n    const enrolledSet = new Set(enrolledSecondFactorMethods);\n    const hasAcceptableEnrollment = acceptableSet.some(m => enrolledSet.has(m));\n\n    const missingMethods = acceptableSet.filter(m => !enrolledSet.has(m));\n\n    return {\n      isComplete: hasAcceptableEnrollment,\n      missingMethods,\n      enrolledMethods: enrolledSecondFactorMethods,\n      requiresEnrollment: !hasAcceptableEnrollment,\n    };\n  }\n}\n"]}
+{"version":3,"file":"auth-session.utils.js","sourceRoot":"","sources":["../../../../src/core/security/auth-session.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAuB,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAUzF,MAAM,+BAA+B,GAA2C;IAC9E,2BAA2B,CAAC,cAAc;IAC1C,2BAA2B,CAAC,iBAAiB;IAC7C,2BAA2B,CAAC,iBAAiB;IAC7C,2BAA2B,CAAC,mBAAmB;IAC/C,2BAA2B,CAAC,sBAAsB;IAClD,2BAA2B,CAAC,4BAA4B;IACxD,2BAA2B,CAAC,+BAA+B;IAC3D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,kCAAkC;IAC9D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,6BAA6B;IACzD,2BAA2B,CAAC,yCAAyC;CAC7D,CAAC;AAEX;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAC3B,gBAAuB,CAAC;IAExB;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAU;QACrC,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,EAAE,UAA6C,CAAC;QACxE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;gBACtC,IAAI,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,sBAAqD,CAAC,EAAE,CAAC;oBAC/G,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrC,IAAI,MAAM,KAAK,cAAc,CAAC,YAAY,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAC5C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;gBACnB,IAAI,+BAA+B,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAmC,CAAC,EAAE,CAAC;oBAC5F,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAU;QACpC,MAAM,UAAU,GAAG,KAAK,EAAE,UAA6C,CAAC;QACxE,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,cAAc,CAAC,SAAS,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAChC,WAAoB,EACpB,mBAAiC,EACjC,2BAAyC,EACzC,oBAAkC;QAElC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,EAAE;gBAClB,eAAe,EAAE,2BAA2B;gBAC5C,kBAAkB,EAAE,KAAK;aAC1B,CAAC;QACJ,CAAC;QAED,iFAAiF;QACjF,EAAE;QACF,mGAAmG;QACnG,mGAAmG;QACnG,0GAA0G;QAC1G,sGAAsG;QACtG,wGAAwG;QACxG,yGAAyG;QACzG,qGAAqG;QACrG,kCAAkC;QAClC,EAAE;QACF,sGAAsG;QACtG,oGAAoG;QACpG,gGAAgG;QAChG,qBAAqB;QACrB,MAAM,aAAa,GAAiB,oBAAoB,CAAC,MAAM,GAAG,CAAC;YACjE,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/E,CAAC,CAAC,mBAAmB,CAAC;QAExB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzD,MAAM,uBAAuB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5E,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtE,OAAO;YACL,UAAU,EAAE,uBAAuB;YACnC,cAAc;YACd,eAAe,EAAE,2BAA2B;YAC5C,kBAAkB,EAAE,CAAC,uBAAuB;SAC7C,CAAC;IACJ,CAAC;CACF","sourcesContent":["import {\n  ErrorType,\n  HttpStatusCode,\n} from '@wildo-ai/saas-models';\nimport { WildoError_Frontend, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\nimport type { AuthMethod } from '@wildo-ai/saas-models';\n\nexport interface AccountCompletenessResult {\n  isComplete: boolean;\n  missingMethods: AuthMethod[];\n  enrolledMethods: AuthMethod[];\n  requiresEnrollment: boolean;\n}\n\nconst AUTHENTICATION_ERROR_REFERENCES: readonly ErrorCustomMessageReference[] = [\n  ErrorCustomMessageReference.AUTHENTICATION,\n  ErrorCustomMessageReference.JWT_TOKEN_EXPIRED,\n  ErrorCustomMessageReference.JWT_TOKEN_INVALID,\n  ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n  ErrorCustomMessageReference.JWT_TOKEN_NOT_VERIFIED,\n  ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n  ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n  ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n  ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED,\n  ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_AUTHORIZED,\n  ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n  ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n  ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n] as const;\n\n/**\n * Static utility class for authentication/session non-component logic.\n */\nexport class AuthSessionUtils {\n  private constructor() {}\n\n  /**\n   * Check if an error is an AUTHENTICATION (session-invalid) error — i.e. the\n   * caller's session/token is missing, expired, or invalid and they must\n   * re-authenticate. This drives the session-restore force-logout, so a false\n   * positive here logs a perfectly valid session out.\n   *\n   * Authentication (401 / session-invalid) and AUTHORIZATION (403 / scope /\n   * permission) are DISTINCT axes and are mutually exclusive: a permission\n   * denial is NOT a reason to destroy the session. We therefore short-circuit\n   * to `false` for any authorization error BEFORE the reference-list check\n   * below — this neutralizes `AUTHENTICATION_USER_NOT_AUTHORIZED`, which is\n   * semantically an authorization concept that merely lives in the\n   * authentication-namespaced `ErrorCustomMessageReference` enum. When it\n   * arrives as a 403 (the realistic case) it is an authorization error, full\n   * stop, and must not log the user out (recovered 2026-06-29: the\n   * session-restore path over-logged-out on scope errors carrying this ref).\n   */\n  static isAuthenticationError(error: any): boolean {\n    if (AuthSessionUtils.isAuthorizationError(error)) {\n      return false;\n    }\n\n    const wildoError = error?.wildoError as WildoError_Frontend | undefined;\n    if (wildoError) {\n      if (wildoError.type === ErrorType.AUTHENTICATION) {\n        return true;\n      }\n      if (wildoError.customMessageReference) {\n        if (AUTHENTICATION_ERROR_REFERENCES.includes(wildoError.customMessageReference as ErrorCustomMessageReference)) {\n          return true;\n        }\n      }\n    }\n\n    if (error?.response?.status) {\n      const status = error.response.status;\n      if (status === HttpStatusCode.UNAUTHORIZED) {\n        return true;\n      }\n    }\n\n    if (error?.response?.data?.error) {\n      const errorData = error.response.data.error;\n      if (errorData.type === ErrorType.AUTHENTICATION) {\n        return true;\n      }\n      if (errorData.code) {\n        if (AUTHENTICATION_ERROR_REFERENCES.includes(errorData.code as ErrorCustomMessageReference)) {\n          return true;\n        }\n      }\n    }\n\n    return false;\n  }\n\n  /**\n   * Check whether an error represents an authorization/scope problem rather than an\n   * invalid or expired authentication session.\n   */\n  static isAuthorizationError(error: any): boolean {\n    const wildoError = error?.wildoError as WildoError_Frontend | undefined;\n    if (wildoError?.type === ErrorType.AUTHORIZATION) {\n      return true;\n    }\n\n    if (error?.response?.status === HttpStatusCode.FORBIDDEN) {\n      return true;\n    }\n\n    if (error?.response?.data?.error?.type === ErrorType.AUTHORIZATION) {\n      return true;\n    }\n\n    return false;\n  }\n\n  /**\n   * D7: Frontend-only computation. Evaluates whether the user has enrolled sufficient\n   * second-factor methods to satisfy the MFA policy.\n   *\n   * @param requiresMFA - Backend-computed flag incorporating app-level + org-level policy\n   * @param availableMFAMethods - Policy-filtered methods from the auth response\n   * @param enrolledSecondFactorMethods - Methods the user has already enrolled\n   * @param acceptableMFAMethods - App-config `mfaPolicy.acceptableMFAMethods` (may be empty)\n   */\n  static evaluateAccountCompleteness(\n    requiresMFA: boolean,\n    availableMFAMethods: AuthMethod[],\n    enrolledSecondFactorMethods: AuthMethod[],\n    acceptableMFAMethods: AuthMethod[],\n  ): AccountCompletenessResult {\n    if (!requiresMFA) {\n      return {\n        isComplete: true,\n        missingMethods: [],\n        enrolledMethods: enrolledSecondFactorMethods,\n        requiresEnrollment: false,\n      };\n    }\n\n    // `acceptableMFAMethods` NARROWS the policy-derived list — it never replaces it.\n    //\n    // This mirrors the backend, where `_getAvailableSecondFactorMethods` seeds its candidates from the\n    // intrinsic factor map and applies `acceptableMFAMethods` as a FILTER, so app config can only ever\n    // subtract methods. Resolving it as a REPLACEMENT here (`acceptable.length > 0 ? acceptable : available`)\n    // widened the set back out to raw config, which could name methods that are impossible for this user:\n    // an SSO redirect flow (intrinsically FIRST_ONLY — never an MFA ceremony, B-SEC-1) or a method disabled\n    // for their user type. `isComplete` was never wrong — it requires an ENROLLED method to match, and those\n    // are never enrolled — but `missingMethods` was, so the enrollment UI could instruct a user to enrol\n    // something they can never enrol.\n    //\n    // An EMPTY intersection is honest, not a regression: it means the policy admits no second factor this\n    // user could satisfy, which the startup config validator now rejects outright as a deadlock — so it\n    // cannot reach production, and surfacing \"enrollment required, nothing offered\" beats naming an\n    // impossible method.\n    const acceptableSet: AuthMethod[] = acceptableMFAMethods.length > 0\n      ? availableMFAMethods.filter((method) => acceptableMFAMethods.includes(method))\n      : availableMFAMethods;\n\n    const enrolledSet = new Set(enrolledSecondFactorMethods);\n    const hasAcceptableEnrollment = acceptableSet.some(m => enrolledSet.has(m));\n\n    const missingMethods = acceptableSet.filter(m => !enrolledSet.has(m));\n\n    return {\n      isComplete: hasAcceptableEnrollment,\n      missingMethods,\n      enrolledMethods: enrolledSecondFactorMethods,\n      requiresEnrollment: !hasAcceptableEnrollment,\n    };\n  }\n}\n"]}

package/dist/esm/core/security/cross-frontend-handoff.frontend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-frontend-handoff.frontend.service.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EACL,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sEAAsE,CAAC;AAE3G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mCAAmC,GAC3C,6BAA6B,GAC7B,iBAAiB,GACjB,SAAS,GACT,oBAAoB,CAAC;AAEzB;;;;;;;;GAQG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAE,mCAAmC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEvB,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;CAMlG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,4BAA4B,CAAC,CAoBvC;AAiED,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,0BAA0B,CAAC;IACnC,IAAI,EAAE,4BAA4B,GAAG,IAAI,CAAC;IAC1C,KAAK,EAAE,+BAA+B,GAAG,IAAI,CAAC;IAC9C,cAAc,EAAE,CACd,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,KACrB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,IAAI,6BAA6B,CAyDvE"}
+{"version":3,"file":"cross-frontend-handoff.frontend.service.d.ts","sourceRoot":"","sources":["../../../../src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EACL,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sEAAsE,CAAC;AAE3G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mCAAmC,GAC3C,6BAA6B,GAC7B,iBAAiB,GACjB,SAAS,GACT,oBAAoB,CAAC;AAEzB;;;;;;;;GAQG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAE,mCAAmC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEvB,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;CAMlG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,4BAA4B,CAAC,CAoBvC;AAiED,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,0BAA0B,CAAC;IACnC,IAAI,EAAE,4BAA4B,GAAG,IAAI,CAAC;IAC1C,KAAK,EAAE,+BAA+B,GAAG,IAAI,CAAC;IAC9C,cAAc,EAAE,CACd,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,KACrB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,IAAI,6BAA6B,CAyDvE"}

package/dist/esm/core/security/cross-frontend-handoff.frontend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"cross-frontend-handoff.frontend.service.js","sourceRoot":"","sources":["../../../../../src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EACL,6BAA6B,GAG9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AA2B7H;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,IAAI,CAAsC;IAC1C,UAAU,CAAgB;IAEnC,YAAY,IAAyC,EAAE,OAAe,EAAE,UAAyB;QAC/F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAkC,EAClC,OAAwB;IAExB,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,QAAiB,EAAE,CAAC;QAC3B,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;QACvC,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,oBAAoB,EACpB,yDAAyD,EACzD,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC;AAE1F;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAiB;IACxC,IAAI,QAAQ,YAAY,+BAA+B;QAAE,OAAO,QAAQ,CAAC;IAEzE,MAAM,SAAS,GAAG,QAKV,CAAC;IAET,MAAM,UAAU,GACd,OAAO,SAAS,EAAE,QAAQ,EAAE,MAAM,KAAK,QAAQ;QAC7C,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;QAC3B,CAAC,CAAC,OAAO,SAAS,EAAE,UAAU,KAAK,QAAQ;YACzC,CAAC,CAAC,SAAS,CAAC,UAAU;YACtB,CAAC,CAAC,IAAI,CAAC;IAEb,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,+BAA+B,CACxC,SAAS,EACT,SAAS,EAAE,OAAO,IAAI,qDAAqD,EAC3E,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,+BAA+B,CACxC,iBAAiB,EACjB,0DAA0D,EAC1D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;QAC/C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;IAE3B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,+BAA+B,CACxC,OAAwC,EACxC,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,+BAA+B,CACxC,oBAAoB,EACpB,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA6B,MAAM,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAyC,IAAI,CAAC,CAAC;IAEjF,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAE5B,SAAS,CAAC,GAAG,EAAE;QACb,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;QAC9B,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,cAAc,GAAG,WAAW,CAChC,KAAK,EACH,KAAkC,EAClC,OAAwB,EACe,EAAE;QACzC,MAAM,MAAM,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC;QACnC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnE,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAClB,SAAS,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,QAAiB,EAAE,CAAC;YAC3B,MAAM,UAAU,GACd,QAAQ,YAAY,+BAA+B;gBACjD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,+BAA+B,CACjC,oBAAoB,EACpB,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,EAC9E,IAAI,CACL,CAAC;YACR,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * Cross-Frontend Handoff helper — first-party SaaS-app wrapper around\n * `POST /api/v1/auth/cross-frontend-handoff` (cross-app-jwt-propagation Step 3).\n *\n * Two surfaces:\n *\n *   1. `requestCrossFrontendHandoff(input)` — vanilla TS / no React. Wraps the\n *      manual-calls HTTP client, maps backend `CrossFrontendHandoffErrorCode`\n *      values onto a typed `CrossFrontendHandoffClientError`, and returns the\n *      `{ handoffUrl, expiresAt }` payload unchanged. The caller decides how\n *      to use the URL (`location.assign` for replace, `window.open` for new\n *      tab) — the helper deliberately does NOT navigate.\n *\n *   2. `useCrossFrontendHandoff()` — thin React hook wrapper for first-party\n *      app components that want `{ status, data, error, requestHandoff, reset }`\n *      ergonomics without bringing React Query in for a one-shot mutation.\n *\n * DTO atoms come from `@wildo-ai/saas-models/public-runtime`\n * (saas-models-public-runtime.md K-7) so the same symbol identity used by the\n * docs-site `docs-auth-client.ts` flows through here. The runtime call delegates\n * to `getManualCallsHttpClient()`, which inherits the auth + frontend-service\n * header injection performed by the base `WildoBackendHttpClient` interceptors.\n *\n * The bearer + `X-Frontend-Service-Name` header are injected automatically by\n * the base client; callers do NOT need to thread them through.\n */\n\nimport { useCallback, useEffect, useRef, useState } from 'react';\nimport {\n  CrossFrontendHandoffErrorCode,\n  type CrossFrontendHandoffRequest,\n  type CrossFrontendHandoffResponse,\n} from '@wildo-ai/saas-models/public-runtime';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport type { RequestOptions } from '~wildo-frontend-lib/core/requests/wildo-http-client.frontend.service';\n\n/**\n * Stable, finite set of error codes a SaaS-app caller may encounter when\n * invoking `requestCrossFrontendHandoff()`.\n *\n * Mirrors the backend enum 1:1 PLUS three runtime-only codes that never reach\n * the wire:\n *\n *   - `unauthenticated` — the caller's bearer is missing/expired/rejected\n *     (HTTP 401). Surfaced WITHOUT trying to parse a backend `code` so the\n *     caller can deep-link to login instead of branching on UNKNOWN_TARGET_*.\n *   - `network`        — no HTTP response was received (offline, DNS, CORS\n *     pre-flight rejection, etc.). The base client retried per its policy\n *     before this code is surfaced.\n *   - `malformed_response` — the request returned 2xx but the body did not\n *     match `CrossFrontendHandoffResponse`, OR the request returned an error\n *     body without a recognizable `error.details.code` field. Treat as a\n *     transient backend incident.\n */\nexport type CrossFrontendHandoffClientErrorCode =\n  | CrossFrontendHandoffErrorCode\n  | 'unauthenticated'\n  | 'network'\n  | 'malformed_response';\n\n/**\n * Typed error thrown by `requestCrossFrontendHandoff()` and stored in the\n * `error` field of `useCrossFrontendHandoff()`.\n *\n * Subclasses native `Error` so `instanceof CrossFrontendHandoffClientError` is\n * the safe way to distinguish from generic axios / network errors at a call\n * site. The `code` discriminator is the contract surface that callers branch\n * on; `httpStatus` is provided for telemetry / Sentry breadcrumbs only.\n */\nexport class CrossFrontendHandoffClientError extends Error {\n  readonly code: CrossFrontendHandoffClientErrorCode;\n  readonly httpStatus: number | null;\n\n  constructor(code: CrossFrontendHandoffClientErrorCode, message: string, httpStatus: number | null) {\n    super(message);\n    this.name = 'CrossFrontendHandoffClientError';\n    this.code = code;\n    this.httpStatus = httpStatus;\n  }\n}\n\n/**\n * Vanilla TS handoff request — no React.\n *\n * Behavior:\n *   - On 2xx with a well-formed body, returns the response unchanged.\n *   - On 2xx with a malformed body, throws `code: 'malformed_response'`.\n *   - On 401, throws `code: 'unauthenticated'` regardless of the backend's\n *     specific code (the base client may already have triggered a refresh-loop\n *     before this branch is reached).\n *   - On other 4xx with a recognized `error.details.code`, throws with that\n *     `CrossFrontendHandoffErrorCode` code so the caller can branch on\n *     `UNKNOWN_TARGET_FRONTEND` vs `TARGET_FRONTEND_HOST_NOT_CONFIGURED`.\n *   - On 4xx/5xx without a recognized code, throws `code: 'malformed_response'`.\n *   - On network failure (no response), throws `code: 'network'`.\n *\n * Pass-through `options` are forwarded to the underlying HTTP client; useful\n * fields: `signal` (AbortController), `silent` (suppress global error toast).\n */\nexport async function requestCrossFrontendHandoff(\n  input: CrossFrontendHandoffRequest,\n  options?: RequestOptions,\n): Promise<CrossFrontendHandoffResponse> {\n  let response: CrossFrontendHandoffResponse;\n  try {\n    response = await getManualCallsHttpClient().crossFrontendHandoff(input, options);\n  } catch (rawError: unknown) {\n    throw mapHandoffError(rawError);\n  }\n\n  if (\n    !response ||\n    typeof response.handoffUrl !== 'string' ||\n    typeof response.expiresAt !== 'string'\n  ) {\n    throw new CrossFrontendHandoffClientError(\n      'malformed_response',\n      'Cross-frontend handoff response missing required fields',\n      null,\n    );\n  }\n  return { handoffUrl: response.handoffUrl, expiresAt: response.expiresAt };\n}\n\nconst HANDOFF_ERROR_CODES = new Set<string>(Object.values(CrossFrontendHandoffErrorCode));\n\n/**\n * Internal — translate any thrown value (axios error, native Error, string,\n * unknown) into a `CrossFrontendHandoffClientError`.\n *\n * The base client's `responseErrorInterceptor` mutates the axios error in\n * place: it sets `error.httpStatus`, `error.context = nested.details`, and\n * preserves the raw envelope on `error.response.data`. We read the raw\n * envelope first (most reliable) and fall back to `error.context` second.\n */\nfunction mapHandoffError(rawError: unknown): CrossFrontendHandoffClientError {\n  if (rawError instanceof CrossFrontendHandoffClientError) return rawError;\n\n  const errorLike = rawError as {\n    response?: { status?: number; data?: { error?: { details?: { code?: unknown } } } };\n    httpStatus?: number;\n    context?: { code?: unknown };\n    message?: string;\n  } | null;\n\n  const httpStatus =\n    typeof errorLike?.response?.status === 'number'\n      ? errorLike.response.status\n      : typeof errorLike?.httpStatus === 'number'\n        ? errorLike.httpStatus\n        : null;\n\n  if (httpStatus === null) {\n    return new CrossFrontendHandoffClientError(\n      'network',\n      errorLike?.message ?? 'Cross-frontend handoff request failed (no response)',\n      null,\n    );\n  }\n\n  if (httpStatus === 401) {\n    return new CrossFrontendHandoffClientError(\n      'unauthenticated',\n      'Cross-frontend handoff requires an authenticated session',\n      401,\n    );\n  }\n\n  const rawCode =\n    errorLike?.response?.data?.error?.details?.code ??\n    errorLike?.context?.code;\n\n  if (typeof rawCode === 'string' && HANDOFF_ERROR_CODES.has(rawCode)) {\n    return new CrossFrontendHandoffClientError(\n      rawCode as CrossFrontendHandoffErrorCode,\n      errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n      httpStatus,\n    );\n  }\n\n  return new CrossFrontendHandoffClientError(\n    'malformed_response',\n    errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n    httpStatus,\n  );\n}\n\nexport type CrossFrontendHandoffStatus = 'idle' | 'pending' | 'success' | 'error';\n\n/**\n * State + action surface returned by `useCrossFrontendHandoff()`.\n *\n * `requestHandoff` returns the resolved `CrossFrontendHandoffResponse` on\n * success and re-throws the typed `CrossFrontendHandoffClientError` on failure\n * — so callers that need to redirect immediately can `await` it without also\n * subscribing to `status`. Hook state (`status` / `data` / `error`) is updated\n * regardless, which is convenient for components that render status without\n * holding a ref to the promise.\n */\nexport interface UseCrossFrontendHandoffResult {\n  status: CrossFrontendHandoffStatus;\n  data: CrossFrontendHandoffResponse | null;\n  error: CrossFrontendHandoffClientError | null;\n  requestHandoff: (\n    input: CrossFrontendHandoffRequest,\n    options?: RequestOptions,\n  ) => Promise<CrossFrontendHandoffResponse>;\n  reset: () => void;\n}\n\n/**\n * React hook wrapper around `requestCrossFrontendHandoff()` for first-party\n * SaaS-app components.\n *\n * Why not `useMutation` / `useReducer`: this is a one-shot, fire-and-forget\n * mutation with no caching / invalidation needs; pulling React Query in for\n * three lines of state would inflate the bundle and force a peer dep that\n * `saas-frontend-lib` does not currently take. `useState` + `useCallback` +\n * an `unmounted` guard cover the use case.\n */\nexport function useCrossFrontendHandoff(): UseCrossFrontendHandoffResult {\n  const [status, setStatus] = useState<CrossFrontendHandoffStatus>('idle');\n  const [data, setData] = useState<CrossFrontendHandoffResponse | null>(null);\n  const [error, setError] = useState<CrossFrontendHandoffClientError | null>(null);\n\n  const unmountedRef = useRef(false);\n  const callIdRef = useRef(0);\n\n  useEffect(() => {\n    unmountedRef.current = false;\n    return () => {\n      unmountedRef.current = true;\n    };\n  }, []);\n\n  const requestHandoff = useCallback(\n    async (\n      input: CrossFrontendHandoffRequest,\n      options?: RequestOptions,\n    ): Promise<CrossFrontendHandoffResponse> => {\n      const callId = ++callIdRef.current;\n      setStatus('pending');\n      setError(null);\n      try {\n        const response = await requestCrossFrontendHandoff(input, options);\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setData(response);\n          setStatus('success');\n        }\n        return response;\n      } catch (rawError: unknown) {\n        const typedError =\n          rawError instanceof CrossFrontendHandoffClientError\n            ? rawError\n            : new CrossFrontendHandoffClientError(\n                'malformed_response',\n                rawError instanceof Error ? rawError.message : 'Cross-frontend handoff failed',\n                null,\n              );\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setError(typedError);\n          setStatus('error');\n        }\n        throw typedError;\n      }\n    },\n    [],\n  );\n\n  const reset = useCallback(() => {\n    callIdRef.current++;\n    setStatus('idle');\n    setData(null);\n    setError(null);\n  }, []);\n\n  return { status, data, error, requestHandoff, reset };\n}\n"]}
+{"version":3,"file":"cross-frontend-handoff.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EACL,6BAA6B,GAG9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AA2B7H;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,IAAI,CAAsC;IAC1C,UAAU,CAAgB;IAEnC,YAAY,IAAyC,EAAE,OAAe,EAAE,UAAyB;QAC/F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAkC,EAClC,OAAwB;IAExB,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,QAAiB,EAAE,CAAC;QAC3B,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;QACvC,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,oBAAoB,EACpB,yDAAyD,EACzD,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC;AAE1F;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAiB;IACxC,IAAI,QAAQ,YAAY,+BAA+B;QAAE,OAAO,QAAQ,CAAC;IAEzE,MAAM,SAAS,GAAG,QAKV,CAAC;IAET,MAAM,UAAU,GACd,OAAO,SAAS,EAAE,QAAQ,EAAE,MAAM,KAAK,QAAQ;QAC7C,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;QAC3B,CAAC,CAAC,OAAO,SAAS,EAAE,UAAU,KAAK,QAAQ;YACzC,CAAC,CAAC,SAAS,CAAC,UAAU;YACtB,CAAC,CAAC,IAAI,CAAC;IAEb,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,+BAA+B,CACxC,SAAS,EACT,SAAS,EAAE,OAAO,IAAI,qDAAqD,EAC3E,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,+BAA+B,CACxC,iBAAiB,EACjB,0DAA0D,EAC1D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;QAC/C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;IAE3B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,+BAA+B,CACxC,OAAwC,EACxC,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,+BAA+B,CACxC,oBAAoB,EACpB,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA6B,MAAM,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAyC,IAAI,CAAC,CAAC;IAEjF,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAE5B,SAAS,CAAC,GAAG,EAAE;QACb,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;QAC9B,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,cAAc,GAAG,WAAW,CAChC,KAAK,EACH,KAAkC,EAClC,OAAwB,EACe,EAAE;QACzC,MAAM,MAAM,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC;QACnC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnE,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAClB,SAAS,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,QAAiB,EAAE,CAAC;YAC3B,MAAM,UAAU,GACd,QAAQ,YAAY,+BAA+B;gBACjD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,+BAA+B,CACjC,oBAAoB,EACpB,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,EAC9E,IAAI,CACL,CAAC;YACR,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * Cross-Frontend Handoff helper — first-party SaaS-app wrapper around\n * `POST /api/v1/auth/cross-frontend-handoff` (cross-app-jwt-propagation Step 3).\n *\n * Two surfaces:\n *\n *   1. `requestCrossFrontendHandoff(input)` — vanilla TS / no React. Wraps the\n *      manual-calls HTTP client, maps backend `CrossFrontendHandoffErrorCode`\n *      values onto a typed `CrossFrontendHandoffClientError`, and returns the\n *      `{ handoffUrl, expiresAt }` payload unchanged. The caller decides how\n *      to use the URL (`location.assign` for replace, `window.open` for new\n *      tab) — the helper deliberately does NOT navigate.\n *\n *   2. `useCrossFrontendHandoff()` — thin React hook wrapper for first-party\n *      app components that want `{ status, data, error, requestHandoff, reset }`\n *      ergonomics without bringing React Query in for a one-shot mutation.\n *\n * DTO atoms come from `@wildo-ai/saas-models/public-runtime`\n * (saas-models-public-runtime.md K-7) so the same symbol identity used by the\n * docs-site `docs-auth-client.ts` flows through here. The runtime call delegates\n * to `getManualCallsHttpClient()`, which inherits the auth + frontend-service\n * header injection performed by the base `WildoBackendHttpClient` interceptors.\n *\n * The bearer + `X-Frontend-Service-Name` header are injected automatically by\n * the base client; callers do NOT need to thread them through.\n */\n\nimport { useCallback, useEffect, useRef, useState } from 'react';\nimport {\n  CrossFrontendHandoffErrorCode,\n  type CrossFrontendHandoffRequest,\n  type CrossFrontendHandoffResponse,\n} from '@wildo-ai/saas-models/public-runtime';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport type { RequestOptions } from '~wildo-frontend-lib/core/requests/wildo-http-client.frontend.service';\n\n/**\n * Stable, finite set of error codes a SaaS-app caller may encounter when\n * invoking `requestCrossFrontendHandoff()`.\n *\n * Mirrors the backend enum 1:1 PLUS three runtime-only codes that never reach\n * the wire:\n *\n *   - `unauthenticated` — the caller's bearer is missing/expired/rejected\n *     (HTTP 401). Surfaced WITHOUT trying to parse a backend `code` so the\n *     caller can deep-link to login instead of branching on UNKNOWN_TARGET_*.\n *   - `network`        — no HTTP response was received (offline, DNS, CORS\n *     pre-flight rejection, etc.). The base client retried per its policy\n *     before this code is surfaced.\n *   - `malformed_response` — the request returned 2xx but the body did not\n *     match `CrossFrontendHandoffResponse`, OR the request returned an error\n *     body without a recognizable `error.details.code` field. Treat as a\n *     transient backend incident.\n */\nexport type CrossFrontendHandoffClientErrorCode =\n  | CrossFrontendHandoffErrorCode\n  | 'unauthenticated'\n  | 'network'\n  | 'malformed_response';\n\n/**\n * Typed error thrown by `requestCrossFrontendHandoff()` and stored in the\n * `error` field of `useCrossFrontendHandoff()`.\n *\n * Subclasses native `Error` so `instanceof CrossFrontendHandoffClientError` is\n * the safe way to distinguish from generic axios / network errors at a call\n * site. The `code` discriminator is the contract surface that callers branch\n * on; `httpStatus` is provided for telemetry / Sentry breadcrumbs only.\n */\nexport class CrossFrontendHandoffClientError extends Error {\n  readonly code: CrossFrontendHandoffClientErrorCode;\n  readonly httpStatus: number | null;\n\n  constructor(code: CrossFrontendHandoffClientErrorCode, message: string, httpStatus: number | null) {\n    super(message);\n    this.name = 'CrossFrontendHandoffClientError';\n    this.code = code;\n    this.httpStatus = httpStatus;\n  }\n}\n\n/**\n * Vanilla TS handoff request — no React.\n *\n * Behavior:\n *   - On 2xx with a well-formed body, returns the response unchanged.\n *   - On 2xx with a malformed body, throws `code: 'malformed_response'`.\n *   - On 401, throws `code: 'unauthenticated'` regardless of the backend's\n *     specific code (the base client may already have triggered a refresh-loop\n *     before this branch is reached).\n *   - On other 4xx with a recognized `error.details.code`, throws with that\n *     `CrossFrontendHandoffErrorCode` code so the caller can branch on\n *     `UNKNOWN_TARGET_FRONTEND` vs `TARGET_FRONTEND_HOST_NOT_CONFIGURED`.\n *   - On 4xx/5xx without a recognized code, throws `code: 'malformed_response'`.\n *   - On network failure (no response), throws `code: 'network'`.\n *\n * Pass-through `options` are forwarded to the underlying HTTP client; useful\n * fields: `signal` (AbortController), `silent` (suppress global error toast).\n */\nexport async function requestCrossFrontendHandoff(\n  input: CrossFrontendHandoffRequest,\n  options?: RequestOptions,\n): Promise<CrossFrontendHandoffResponse> {\n  let response: CrossFrontendHandoffResponse;\n  try {\n    response = await getManualCallsHttpClient().crossFrontendHandoff(input, options);\n  } catch (rawError: unknown) {\n    throw mapHandoffError(rawError);\n  }\n\n  if (\n    !response ||\n    typeof response.handoffUrl !== 'string' ||\n    typeof response.expiresAt !== 'string'\n  ) {\n    throw new CrossFrontendHandoffClientError(\n      'malformed_response',\n      'Cross-frontend handoff response missing required fields',\n      null,\n    );\n  }\n  return { handoffUrl: response.handoffUrl, expiresAt: response.expiresAt };\n}\n\nconst HANDOFF_ERROR_CODES = new Set<string>(Object.values(CrossFrontendHandoffErrorCode));\n\n/**\n * Internal — translate any thrown value (axios error, native Error, string,\n * unknown) into a `CrossFrontendHandoffClientError`.\n *\n * The base client's `responseErrorInterceptor` mutates the axios error in\n * place: it sets `error.httpStatus`, `error.context = nested.details`, and\n * preserves the raw envelope on `error.response.data`. We read the raw\n * envelope first (most reliable) and fall back to `error.context` second.\n */\nfunction mapHandoffError(rawError: unknown): CrossFrontendHandoffClientError {\n  if (rawError instanceof CrossFrontendHandoffClientError) return rawError;\n\n  const errorLike = rawError as {\n    response?: { status?: number; data?: { error?: { details?: { code?: unknown } } } };\n    httpStatus?: number;\n    context?: { code?: unknown };\n    message?: string;\n  } | null;\n\n  const httpStatus =\n    typeof errorLike?.response?.status === 'number'\n      ? errorLike.response.status\n      : typeof errorLike?.httpStatus === 'number'\n        ? errorLike.httpStatus\n        : null;\n\n  if (httpStatus === null) {\n    return new CrossFrontendHandoffClientError(\n      'network',\n      errorLike?.message ?? 'Cross-frontend handoff request failed (no response)',\n      null,\n    );\n  }\n\n  if (httpStatus === 401) {\n    return new CrossFrontendHandoffClientError(\n      'unauthenticated',\n      'Cross-frontend handoff requires an authenticated session',\n      401,\n    );\n  }\n\n  const rawCode =\n    errorLike?.response?.data?.error?.details?.code ??\n    errorLike?.context?.code;\n\n  if (typeof rawCode === 'string' && HANDOFF_ERROR_CODES.has(rawCode)) {\n    return new CrossFrontendHandoffClientError(\n      rawCode as CrossFrontendHandoffErrorCode,\n      errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n      httpStatus,\n    );\n  }\n\n  return new CrossFrontendHandoffClientError(\n    'malformed_response',\n    errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n    httpStatus,\n  );\n}\n\nexport type CrossFrontendHandoffStatus = 'idle' | 'pending' | 'success' | 'error';\n\n/**\n * State + action surface returned by `useCrossFrontendHandoff()`.\n *\n * `requestHandoff` returns the resolved `CrossFrontendHandoffResponse` on\n * success and re-throws the typed `CrossFrontendHandoffClientError` on failure\n * — so callers that need to redirect immediately can `await` it without also\n * subscribing to `status`. Hook state (`status` / `data` / `error`) is updated\n * regardless, which is convenient for components that render status without\n * holding a ref to the promise.\n */\nexport interface UseCrossFrontendHandoffResult {\n  status: CrossFrontendHandoffStatus;\n  data: CrossFrontendHandoffResponse | null;\n  error: CrossFrontendHandoffClientError | null;\n  requestHandoff: (\n    input: CrossFrontendHandoffRequest,\n    options?: RequestOptions,\n  ) => Promise<CrossFrontendHandoffResponse>;\n  reset: () => void;\n}\n\n/**\n * React hook wrapper around `requestCrossFrontendHandoff()` for first-party\n * SaaS-app components.\n *\n * Why not `useMutation` / `useReducer`: this is a one-shot, fire-and-forget\n * mutation with no caching / invalidation needs; pulling React Query in for\n * three lines of state would inflate the bundle and force a peer dep that\n * `saas-frontend-lib` does not currently take. `useState` + `useCallback` +\n * an `unmounted` guard cover the use case.\n */\nexport function useCrossFrontendHandoff(): UseCrossFrontendHandoffResult {\n  const [status, setStatus] = useState<CrossFrontendHandoffStatus>('idle');\n  const [data, setData] = useState<CrossFrontendHandoffResponse | null>(null);\n  const [error, setError] = useState<CrossFrontendHandoffClientError | null>(null);\n\n  const unmountedRef = useRef(false);\n  const callIdRef = useRef(0);\n\n  useEffect(() => {\n    unmountedRef.current = false;\n    return () => {\n      unmountedRef.current = true;\n    };\n  }, []);\n\n  const requestHandoff = useCallback(\n    async (\n      input: CrossFrontendHandoffRequest,\n      options?: RequestOptions,\n    ): Promise<CrossFrontendHandoffResponse> => {\n      const callId = ++callIdRef.current;\n      setStatus('pending');\n      setError(null);\n      try {\n        const response = await requestCrossFrontendHandoff(input, options);\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setData(response);\n          setStatus('success');\n        }\n        return response;\n      } catch (rawError: unknown) {\n        const typedError =\n          rawError instanceof CrossFrontendHandoffClientError\n            ? rawError\n            : new CrossFrontendHandoffClientError(\n                'malformed_response',\n                rawError instanceof Error ? rawError.message : 'Cross-frontend handoff failed',\n                null,\n              );\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setError(typedError);\n          setStatus('error');\n        }\n        throw typedError;\n      }\n    },\n    [],\n  );\n\n  const reset = useCallback(() => {\n    callIdRef.current++;\n    setStatus('idle');\n    setData(null);\n    setError(null);\n  }, []);\n\n  return { status, data, error, requestHandoff, reset };\n}\n"]}