npm - @wildo-ai/saas-frontend-lib - Versions diffs - 1.1.4 → 1.1.5 - Mend

@wildo-ai/saas-frontend-lib 1.1.4 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2512) hide show

package/dist/esm/core/security/UserOrgsContext.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UserOrgsContext.js","sourceRoot":"","sources":["../../../../src/core/security/UserOrgsContext.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,aAAa,EAAE,QAAQ,EAAa,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC3G,OAAO,EAGL,gBAAgB,EAChB,kCAAkC,EAClC,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EAIrB,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,6CAA6C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAIzF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAEhG,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AACxE,MAAM,QAAQ,GAAiE,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;AACrH,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AA4C1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmD,aAAa,CAAkC,SAAS,CAAC,CAAC;AAEzI,MAAM,CAAC,MAAM,gBAAgB,GAAsC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IAClF,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAE/B,+BAA+B;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,MAAM,EAAE,UAAU,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,GAAG,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,4BAA4B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC/D,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IAE7D,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,gBAAgB,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IACrD,yEAAyE;IACzE,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,oBAAoB,GAAG,MAAM,CAAuC,IAAI,CAAC,CAAC;IAEhF,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAE3D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAwB,EAAE,CAAC,CAAC;IAE9E,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAGpC,IAAI,CAAC,CAAC;IAEhB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAIjE;;;;;;;;;OASG;IACH,MAAM,8BAA8B,GAAG,CACrC,uBAA8E,EACrD,EAAE;QAC3B,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,uBAAuB,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,+BAA+B,EAAE,uBAAuB,CAAC,mBAAmB,IAAI,IAAI;YACpF,+BAA+B,EAAE;gBAC/B,QAAQ,EAAE,uBAAuB,CAAC,QAAQ;gBAC1C,MAAM,EAAE,uBAAuB,CAAC,MAAM;gBACtC,UAAU,EAAE,uBAAuB,CAAC,UAAU;gBAC9C,UAAU,EAAE,uBAAuB,CAAC,UAAU;aAC/C;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,sBAAsB,GAAG,WAAW,CAAC,CACzC,WAAkD,EAClD,uBAAmE,EAC7D,EAAE;QACR,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;gBAC5C,mBAAmB,EAAE,IAAI;gBACzB,+BAA+B,EAAE,IAAI;gBACrC,mBAAmB,EAAE,IAAI;gBACzB,+BAA+B,EAAE,IAAI;gBACrC,wBAAwB,EAAE,IAAI;gBAC9B,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;YAC5C,GAAG,CAAC,WAAW,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnH,GAAG,8BAA8B,CAAC,uBAAuB,CAAC;YAC1D,GAAG,CAAC,WAAW,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,WAAW,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,MAAM,wBAAwB,GAAG,OAAO,CAAuC,GAAG,EAAE;QAClF,OAAO,iBAAiB,CAAC,iBAAiB,CAAC;YACzC,MAAM,EAAE,QAAQ,CAAC,aAAa;YAC9B,cAAc,EAAE,QAAQ,CAAC,qBAAqB;YAC9C,aAAa,EAAE,QAAQ,CAAC,oBAAoB;YAC5C,eAAe,EAAE,QAAQ,CAAC,sBAAsB;SACjD,CAAC,CAAC;IACL,CAAC,EAAE;QACD,QAAQ,CAAC,oBAAoB;QAC7B,QAAQ,CAAC,sBAAsB;QAC/B,QAAQ,CAAC,qBAAqB;QAC9B,QAAQ,CAAC,aAAa;KACvB,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,CACnC,WAA+B,EAC/B,uBAAmE,EAC7D,EAAE;QACR,qCAAqC;QACrC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,8BAA8B,GAAG,uBAAuB,KAAK,SAAS;YAC1E,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,qBAAqB;gBACrB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,WAAW;gBAC/F,CAAC,CAAC,SAAS,CAAC;QAEhB,yDAAyD;QACzD,sBAAsB,CACpB,WAAW,EACX,8BAA8B,CAC/B,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,CAAC,CAAC,CAAC;IAEnE;;;OAGG;IACH,MAAM,2BAA2B,GAAG,CAClC,WAAwB,EACxB,iBAAwC,EACX,EAAE;QAC/B,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAa,CAAC;QAE1D,kEAAkE;QAClE,qDAAqD;QACrD,MAAM,wBAAwB,GAA6B,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE1D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,wBAAwB,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAa,CAAC;QAC7F,CAAC;QAED,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,wBAAwB;SACxC,CAAC;IACJ,CAAC,CAAC;IAEF;;OAEG;IACH,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAwB,EAGlE,EAAE;QACH,MAAM,cAAc,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE7D,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;YAC1D,CAAC,CAAC,YAAY,CAAC,iBAAiB,EAAE;YAClC,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,WAAW,GAAG,WAAW;YAC7B,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC;YACrE,CAAC,CAAC,cAAc,CAAC;QAEnB,QAAQ,CAAC,uBAAuB,EAAE;YAChC,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,eAAe,EAAE,WAAW,CAAC,MAAM;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;SACnD,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAA0B,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,mBAAmB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC5F,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;gBACpD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CACjE,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;gBACrD,EAAE,CAAC,kBAAkB,KAAK,IAAI;gBAC9B,EAAE,CAAC,eAAe,KAAK,IAAI;gBAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;oBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE,CACF,CAAC;YAEF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBACtD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,MAAM,0BAA0B,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,UAAU,CAAC,CAAC;YAErH;;;;;;;;;;;;;;;;;;;;;;eAsBG;YACH,MAAM,6BAA6B,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;YACjH,MAAM,6BAA6B,GAAG,6BAA6B,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CAChG,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;gBACrD,EAAE,CAAC,kBAAkB,KAAK,IAAI;gBAC9B,EAAE,CAAC,eAAe,KAAK,IAAI;gBAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;oBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE,CACF,CAAC;YAEF,IAAI,CAAC,6BAA6B,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;YAClH,CAAC;YAED,MAAM,oCAAoC,GAAG,6BAA6B;gBACxE,CAAC,CAAC,kCAAkC,CAAC,kCAAkC,CAAC,6BAA6B,CAAC;gBACtG,CAAC,CAAC,IAAI,CAAC;YAET,MAAM,4BAA4B,GAAG,KAAK,EACxC,cAAsB,EACmC,EAAE;gBAC3D,IAAI,CAAC,oCAAoC;oBAAE,OAAO,SAAS,CAAC;gBAC5D,IAAI,CAAC;oBACH,OAAO,MAAM,WAAW,CACtB,oCAAoC,EACpC,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,EAAE,CAC7C,IAAI,SAAS,CAAC;gBACjB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;oBACnF,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAe,EAAE,EAAE;gBAC5D,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBAC3C,WAAW,CACT,0BAA0B,EAC1B,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC1E,4BAA4B,CAAC,UAAU,CAAC,cAAc,CAAC;qBACxD,CAAC,CAAC;oBAEH,IAAI,CAAC,GAAG;wBAAE,OAAO,IAAI,CAAC;oBACtB,sFAAsF;oBACtF,uFAAuF;oBACvF,sFAAsF;oBACtF,qFAAqF;oBACrF,8BAA8B;oBAC9B,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACrD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;oBAClG,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,iBAAiB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAA8B,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC;QAClG,CAAC;QAED,yCAAyC;QACzC,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACrD,MAAM,aAAa,GAAG,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC;YACrF,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;QAEtC,2CAA2C;QAC3C,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAExF,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACpC,4BAA4B,CAAC,aAAa,CAAC,CAAC;QAC5C,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAEpC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC,CAAC;QACxH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC,EAAE,CAAC,4BAA4B,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1F;;OAEG;IACH,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAmB,EAAoB,EAAE;QACrF,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAEnC,kCAAkC;QAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAE5E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEnF,MAAM,aAAa,GAAG,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CACjE,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;YACrD,EAAE,CAAC,kBAAkB,KAAK,IAAI;YAC9B,EAAE,CAAC,eAAe,KAAK,IAAI;YAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;gBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE,CACF,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,MAAM,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CAC/D,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;YACrD,EAAE,CAAC,eAAe,KAAK,IAAI;YAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;gBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE;YACD,EAAE,CAAC,UAAU,KAAK,qBAAqB,CAAC,OAAO,CAChD,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC;QAEnG,MAAM,oBAAoB,GAA2B,EAAE,CAAC;QAExD,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,gBAAgB,CAAsB,WAAW,CAAC,CAAC;gBACnE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,oBAAoB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC/C,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,MAAM,WAAW,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,aAAa,CAAC,CAAC;QACzG,MAAM,WAAW,GAAG,MAAM,WAAW,CAAc,WAAW,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,CAAC,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACxE,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEpG,oBAAoB;QACpB,OAAO,CAAC,WAAW,CAAC,CAAC;QAErB,gCAAgC;QAChC,+EAA+E;QAC/E,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAElF,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,mBAAmB,GAAG,aAAa;gBACvC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,aAAa,CAAC;gBAC9E,CAAC,CAAC,IAAI,CAAC;YACT,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC3C,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,iBAAiB,EAAE,gBAAgB;SACpC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,6EAA6E;IAC7E,SAAS,CAAC,GAAG,EAAE;QACb,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,OAAO,GAAG,EAAE;YACV,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,IAAI,oBAAoB,CAAC,OAAO,EAAE,CAAC;gBACjC,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC3C,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACtC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;;;;;;;OAUG;IACH,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,IAAsB,EAAE;QAC9D,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAEhD,+EAA+E;QAC/E,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YACrD,QAAQ,CAAC,gDAAgD,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,gEAAgE;QAChE,uEAAuE;QACvE,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBAEvD,IAAI,QAAQ,EAAE,CAAC;oBACb,mBAAmB,EAAE,CAAC;oBAEtB,mFAAmF;oBACnF,6EAA6E;oBAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;wBAC7C,oEAAoE;wBACpE,oEAAoE;wBACpE,oEAAoE;wBACpE,0DAA0D;wBAC1D,mEAAmE;wBACnE,2DAA2D;wBAC3D,mEAAmE;wBACnE,sEAAsE;wBACtE,wEAAwE;wBACxE,2EAA2E;wBAC3E,qEAAqE;wBACrE,2CAA2C;wBAC3C,MAAM,mBAAmB,GAAG,YAAY,CAAC,cAAc,EAAE,IAAI,WAAW,CAAC;wBACzE,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC;oBAC1E,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,+GAA+G,CAAC,CAAC;oBAC7H,UAAU,EAAE,CAAC;gBACf,CAAC;gBAED,OAAO,QAAQ,CAAC;YAElB,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,yEAAyE;gBACzE,uEAAuE;gBACvE,kEAAkE;gBAClE,qEAAqE;gBACrE,sEAAsE;gBACtE,0EAA0E;gBAC1E,kCAAkC;gBAClC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAE1E,IAAI,oBAAoB,EAAE,CAAC;oBACzB,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,8CAA8C,CAAC;oBACtF,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;wBACvE,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAC3B,mBAAmB,EAAE,CAAC;oBACtB,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,yEAAyE;gBACzE,sEAAsE;gBACtE,mEAAmE;gBACnE,yEAAyE;gBACzE,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrC,OAAO,IAAI,CAAC,CAAC;oBACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,2BAA2B,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAChD,0BAA0B,CAC3B,CAAC;oBACF,MAAM,CAAC,IAAI,CAAC,sFAAsF,EAAE;wBAClG,OAAO;wBACP,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;wBAC/B,IAAI,EAAE,KAAK,EAAE,IAAI;qBAClB,CAAC,CAAC;oBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;wBAClC,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC5D,CAAC,CAAC,CAAC;oBACH,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC9D,mBAAmB,CAAC,KAAK,CAAC,CAAC;wBAC3B,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClD,QAAQ,CAAC,wDAAwD,EAAE;wBACjE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,UAAU,EAAE,CAAC;oBACb,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,uEAAuE;gBACvE,wEAAwE;gBACxE,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,4BAA4B,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;oBAChF,KAAK,EAAE,YAAY;oBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI;iBACnC,CAAC,CAAC;gBAEH,UAAU,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC,EAAE;QACD,kBAAkB;QAClB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI;QACJ,UAAU;QACV,mBAAmB;QACnB,mBAAmB;QACnB,gBAAgB;QAChB,YAAY;KACb,CAAC,CAAC;IAEH;;OAEG;IACH,MAAM,oBAAoB,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACjE,qDAAqD;QACrD,MAAM,WAAW,GAAG,IAAI,EAAE,mBAAmB,IAAI,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,wCAAwC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,0BAA0B,EAAE,EAAE,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9E,mCAAmC;QACnC,MAAM,iBAAiB,CAAC,IAAK,CAAC,CAAC;IACjC,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE9B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,GAAG,qBAAqB;YAC/C,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC;YAClF,CAAC,CAAC,IAAI,CAAC;QAET,sBAAsB,CACpB,IAAI,CAAC,mBAAmB,EACxB,mBAAmB,EAAE,WAAW,CACjC,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,CAAC,cAAsB,EAAQ,EAAE;QAC1E,4DAA4D;QAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QAED,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;QAErD,0CAA0C;QAC1C,IAAI,sBAAsB,KAAK,cAAc,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,CAAC,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACjH,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC,EAAE,CAAC,aAAa,EAAE,qBAAqB,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,GAA+B,EAAE;QAC1E,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,qBAAqB,CAAC,IAAI,IAAI,CAAC;IAC1E,CAAC,EAAE,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC,CAAC;IAE3C;;OAEG;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,GAAuB,EAAE;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd;;OAEG;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAS,EAAE;QACpC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAE3F,4BAA4B;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACnC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAE7B,4BAA4B;QAC5B,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QAClC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEhC,0DAA0D;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE,UAAU,EAAE,4BAA4B,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAEzG,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,2CAA2C;QAC3C,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;YACvC,OAAO;QACT,CAAC;QAED,+BAA+B;QAC/B,IAAI,iBAAiB,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,+CAA+C,EAAE;YACxD,QAAQ,EAAE,CAAC,CAAC,WAAW;YACvB,aAAa,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO;SAC1C,CAAC,CAAC;QAEH,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;QACvC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEjC,6CAA6C;QAC7C,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/B,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5F,gDAAgD;IAChD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAClD,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;YACnC,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC7B,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QACpC,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,4BAA4B,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,OAAO,CAAsB,GAAG,EAAE,CAAC,CAAC;QAChD,0DAA0D;QAC1D,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QAEd,uEAAuE;QACvE,mBAAmB;QACnB,sBAAsB;QAEtB,YAAY;QACZ,IAAI;QAEJ,oBAAoB;QACpB,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QAExB,yCAAyC;QACzC,OAAO;QAEP,0BAA0B;QAC1B,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QAEpB,iBAAiB;QACjB,UAAU;KACX,CAAC,EAAE;QACF,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QACd,mBAAmB;QACnB,sBAAsB;QACtB,IAAI;QACJ,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QACxB,OAAO;QACP,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QACpB,UAAU;KACX,CAAC,CAAC;IAEH,OAAO,KAAC,eAAe,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA4B,CAAC;AACvF,CAAC,CAAC","sourcesContent":["import React, { createContext, useState, ReactNode, useMemo, useEffect, useCallback, useRef } from 'react';\nimport {\n UserContext,\n OrganizationContext,\n CoreResourceType,\n ResourcesConfig_OperationPathUtils,\n CoreResourceOperation,\n ResourceOperationVariantType,\n OPERATION_VARIANT_KEY,\n ExecutionContext_InitiatorIds,\n UserPrivacy,\n UserPreferences,\n SessionType,\n} from '@wildo-ai/saas-models';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useEventBus } from '~wildo-frontend-lib/core/events/useEventBus';\nimport { FrontendEvents } from '~wildo-frontend-lib/core/events/events.frontend.schemas';\nimport {\n EffectivePermissions,\n} from './security.frontend.schemas';\nimport { useAuthSession } from './useAuthSession';\nimport { AuthSessionUtils } from './auth-session.utils';\nimport { isTransientBackendFailure } from '~wildo-frontend-lib/core/requests/auth-refresh-resilience.frontend';\nimport { decodeJwtPayload } from './jwt.frontend.utils';\nimport { useAppScope } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { useAppScopeInternal } from '~wildo-frontend-lib/core/scope/AppScopeContext';\nimport { ScopeUtilsService } from '~wildo-frontend-lib/core/scope/scope.utils.frontend.service';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\nconst logDebug: (message: string, context?: Record<string, unknown>) => void = logger.debugByType('UserOrgsContext');\nlogger.setDebugTypeLogging('UserOrgsContext', false);\n\n/*\n Session-restore retry backoff bounds (transient backend failures only).\n \n On RELOAD, a backend that is recompiling/restarting (dev) or briefly\n * unavailable (prod) makes the session-restore fetch fail transiently. Rather\n * than force a logout — which clears the shared `__wildo_refresh` cookie and\n * drops the user to the login screen — restore preserves the session and\n * retries with exponential backoff until the backend returns. Genuine auth/authz\n * and non-network errors do NOT retry (see `restoreSession`). Backoff caps so a\n * sustained outage settles at one attempt per {@link RESTORE_RETRY_MAX_DELAY_MS}.\n /\nconst RESTORE_RETRY_BASE_DELAY_MS = 1_000;\nconst RESTORE_RETRY_MAX_DELAY_MS = 30_000;\n\n/\n User Organizations Context\n * Manages user data, organizations, permissions, and preferences\n * Consumes AuthSessionContext for authentication state\n /\n\nexport interface UserOrgsContextType {\n // Re-exported from AuthSession for backward compatibility\n auth: ReturnType<typeof useAuthSession>['auth'];\n identifyByEmail: ReturnType<typeof useAuthSession>['identifyByEmail'];\n authenticateWithPassword: ReturnType<typeof useAuthSession>['authenticateWithPassword'];\n authenticate: ReturnType<typeof useAuthSession>['authenticate'];\n getSessionState: ReturnType<typeof useAuthSession>['getSessionState'];\n isAuthenticated: ReturnType<typeof useAuthSession>['isAuthenticated'];\n logout: () => void;\n restoreSession: () => Promise<boolean>;\n\n // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n initiateOAuth2Login: ReturnType<typeof useAuthSession>['initiateOAuth2Login'];\n handleAuthCodeExchange: ReturnType<typeof useAuthSession>['handleAuthCodeExchange'];\n\n // User data\n user: UserContext \| null;\n\n // Organization data\n organizations: OrganizationContext[];\n currentOrganizationId: string \| null;\n permissions: EffectivePermissions \| null;\n primaryScopeInitiatorIds: ExecutionContext_InitiatorIds \| null;\n\n // Privacy (only preference managed here, others are in their respective contexts)\n privacy: UserPrivacy \| null;\n\n // Organization management\n setCurrentOrganization: (organizationId: string) => void;\n getCurrentOrganization: () => OrganizationContext \| null;\n refreshOrganizations: () => Promise<void>;\n\n // Privacy getter\n getPrivacy: () => UserPrivacy \| null;\n}\n\n/\n UserOrgs Context\n * Exported for use in separate hook file (Fast Refresh compatibility)\n * @internal - Use useUserOrgs() hook instead of accessing this directly\n /\nexport const UserOrgsContext: React.Context<UserOrgsContextType \| undefined> = createContext<UserOrgsContextType \| undefined>(undefined);\n\nexport const UserOrgsProvider: React.FC<{ children: ReactNode }> = ({ children }) => {\n const { doOperation, registry } = useResourceRegistry();\n const { emit } = useEventBus();\n\n // Consume auth session context\n const authSession = useAuthSession();\n const {\n auth,\n tokenStorage,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout: authLogout,\n initiateOAuth2Login,\n handleAuthCodeExchange,\n markSessionRestored,\n setSessionRestoring,\n connectWebSocket,\n } = authSession;\n const appScope = useAppScope();\n const { commitOrganizationScopeValue } = useAppScopeInternal();\n const currentOrganizationId = appScope.currentOrganizationId;\n\n const hasInitializedRef = useRef(false);\n const previousTokenRef = useRef<string \| null>(null);\n // Restore-retry lifecycle: `restoreAbortRef` flips true on unmount so an\n // in-flight backoff loop bails instead of touching state on a dead component;\n // `restoreRetryTimerRef` holds the pending backoff timer for cleanup.\n const restoreAbortRef = useRef(false);\n const restoreRetryTimerRef = useRef<ReturnType<typeof setTimeout> \| null>(null);\n\n const [user, setUser] = useState<UserContext \| null>(null);\n\n const [organizations, setOrganizations] = useState<OrganizationContext[]>([]);\n\n const [permissions, setPermissions] = useState<{\n appLevel: string[];\n organizations: Record<string, string[]>;\n } \| null>(null);\n\n const [privacy, setPrivacy] = useState<UserPrivacy \| null>(null);\n\n type PreferencesPayload = Pick<UserPreferences, 'languagePreferences' \| 'regional' \| 'ui' \| 'notifications' \| 'privacy'>;\n\n /\n The TENANT's half of the payload, derived from its preferences record rather than passed\n * alongside it (#410).\n \n The organization contributes two things to `I18nContext` — its language policy and its regional\n * defaults — and they are forwarded together because they come from one record. An earlier shape\n * took the language block as its own argument, and when the regional half was added every call\n * site would have had to remember to forward a second one: three sites, one obligation each, and\n * a fourth site tomorrow that forwards neither. Passing the record makes forgetting impossible.\n /\n const organizationPreferencesPayload = (\n organizationPreferences: OrganizationContext['preferences'] \| null \| undefined,\n ): Record<string, unknown> => {\n if (organizationPreferences === undefined) {\n return {};\n }\n if (organizationPreferences === null) {\n return { organizationLanguagePreferences: null, organizationRegionalPreferences: null };\n }\n return {\n organizationLanguagePreferences: organizationPreferences.languagePreferences ?? null,\n organizationRegionalPreferences: {\n timezone: organizationPreferences.timezone,\n locale: organizationPreferences.locale,\n dateFormat: organizationPreferences.dateFormat,\n timeFormat: organizationPreferences.timeFormat,\n },\n };\n };\n\n const emitPreferencesChanged = useCallback((\n preferences: PreferencesPayload \| null \| undefined,\n organizationPreferences?: OrganizationContext['preferences'] \| null,\n ): void => {\n if (preferences === null) {\n emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n languagePreferences: null,\n organizationLanguagePreferences: null,\n regionalPreferences: null,\n organizationRegionalPreferences: null,\n notificationsPreferences: null,\n uiPreferences: null,\n privacy: null,\n });\n return;\n }\n\n emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n ...(preferences?.languagePreferences !== undefined ? { languagePreferences: preferences.languagePreferences } : {}),\n ...organizationPreferencesPayload(organizationPreferences),\n ...(preferences?.regional !== undefined ? { regionalPreferences: preferences.regional } : {}),\n ...(preferences?.notifications !== undefined ? { notificationsPreferences: preferences.notifications } : {}),\n ...(preferences?.ui !== undefined ? { uiPreferences: preferences.ui } : {}),\n ...(preferences?.privacy !== undefined ? { privacy: preferences.privacy } : {}),\n });\n }, [emit]);\n\n const primaryScopeInitiatorIds = useMemo<ExecutionContext_InitiatorIds \| null>(() => {\n return ScopeUtilsService.buildInitiatorIds({\n userId: appScope.currentUserId,\n organizationId: appScope.currentOrganizationId,\n applicationId: appScope.currentApplicationId,\n anonymousUserId: appScope.currentAnonymousUserId,\n });\n }, [\n appScope.currentApplicationId,\n appScope.currentAnonymousUserId,\n appScope.currentOrganizationId,\n appScope.currentUserId,\n ]);\n\n /\n Extract and store user preferences from context\n * Stores preferences in state for other contexts to read and apply\n /\n const storePreferences = useCallback((\n preferences: PreferencesPayload,\n organizationPreferences?: OrganizationContext['preferences'] \| null,\n ): void => {\n // Store privacy preferences in state\n if (preferences.privacy) {\n setPrivacy(preferences.privacy);\n }\n\n const currentOrganizationPreferences = organizationPreferences !== undefined\n ? organizationPreferences\n : currentOrganizationId\n ? organizations.find((organization) => organization._id === currentOrganizationId)?.preferences\n : undefined;\n\n // Emit preference change event to notify parent contexts\n emitPreferencesChanged(\n preferences,\n currentOrganizationPreferences,\n );\n }, [currentOrganizationId, emitPreferencesChanged, organizations]);\n\n /\n Compute effective permissions from user's app roles and organization roles\n * This is a basic implementation - can be enhanced based on role hierarchy\n /\n const computeEffectivePermissions = (\n userContext: UserContext,\n organizationsList: OrganizationContext[]\n ): EffectivePermissions \| null => {\n // App-level permissions from user's app roles\n const appLevel = (userContext.appRoles \|\| []) as string[];\n\n // Per-organization permissions from organization membership roles\n // Use new field name from relationship-based context\n const organizationsPermissions: Record<string, string[]> = {};\n const memberships = userContext.organizationMembers \|\| [];\n\n for (const membership of memberships) {\n organizationsPermissions[membership.organizationId] = (membership.roles \|\| []) as string[];\n }\n\n return {\n appLevel,\n organizations: organizationsPermissions,\n };\n };\n\n /\n Load organizations independently (can be called separately from authentication)\n /\n const loadOrganizations = useCallback(async (userContext: UserContext): Promise<{\n organizationsList: OrganizationContext[];\n selectedOrgId: string \| null;\n }> => {\n const allMemberships = userContext.organizationMembers \|\| [];\n\n // W7.3b: For one-off sessions, restrict to the scoped organization only\n const scopedOrgId = auth.sessionType === SessionType.ONE_OFF\n ? tokenStorage.getOrganizationId()\n : null;\n\n const memberships = scopedOrgId\n ? allMemberships.filter((m: any) => m.organizationId === scopedOrgId)\n : allMemberships;\n\n logDebug('Loading organizations', {\n userId: userContext._id,\n membershipCount: memberships.length,\n isOneOff: auth.sessionType === SessionType.ONE_OFF,\n });\n\n const organizationsList: OrganizationContext[] = [];\n\n if (memberships.length > 0) {\n const organizationsConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];\n if (!organizationsConfig) {\n logger.warn('ORGANIZATIONS resource not available');\n return { organizationsList, selectedOrgId: null };\n }\n\n const orgsReadOp = organizationsConfig.operations.find((op: any) =>\n op.operationIdentifier === CoreResourceOperation.READ &&\n op.isOperationDefault === true &&\n op.isBulkOperation !== true &&\n (\n op.variantType === ResourceOperationVariantType.API_CALL \|\|\n op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n )\n );\n\n if (!orgsReadOp) {\n logger.warn('ORGANIZATIONS READ operation not found');\n return { organizationsList, selectedOrgId: null };\n }\n\n const organizationsOperationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(orgsReadOp);\n\n /\n The tenant's preference record is fetched SEPARATELY, and that is a decision rather than an\n * omission (#563).\n \n `OrganizationContextSchema` declares `preferences`, and `doOperation<OrganizationContext>`\n * is a CAST — nothing validates the response against it — so the field read as available\n * while no producer existed: the ORGANIZATIONS default READ returns a plain\n * `Organization`, and the organisation's regional block therefore never reached\n * `I18nContext`. Every date and number in every generated application formatted at the\n * framework floor as a result.\n \n The rejected alternative was to switch this call to the ORGANIZATIONS context variant,\n * which does populate the child. Measured against the running stack on 2026-09-10, that\n * response carries every context-enabled child of an organisation — `auditLogs`, `todos`,\n * `tasks`, `knowledgeDocuments`, `organizationMembers`, … — so session restore would pull an\n * unbounded page of tenant data per membership to obtain four regional fields. The\n * preference record has its own default READ (`GET /organizations/{id}/organization-preference`,\n * reachable by an ordinary `ORG_MEMBER`), which is one small request with a stable shape.\n \n Best-effort by construction: a tenant whose preferences cannot be read still yields a\n * usable organisation, and `organizationPreferencesPayload(undefined)` then contributes\n * nothing to the i18n event rather than clearing the member's own settings.\n /\n const organizationPreferencesConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES];\n const organizationPreferencesReadOp = organizationPreferencesConfig?.operations?.find((op: any) =>\n op.operationIdentifier === CoreResourceOperation.READ &&\n op.isOperationDefault === true &&\n op.isBulkOperation !== true &&\n (\n op.variantType === ResourceOperationVariantType.API_CALL \|\|\n op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n )\n );\n\n if (!organizationPreferencesReadOp) {\n logger.warn('ORGANIZATION_PREFERENCES READ operation not found — tenant regional defaults will not be applied');\n }\n\n const organizationPreferencesOperationPath = organizationPreferencesReadOp\n ? ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(organizationPreferencesReadOp)\n : null;\n\n const fetchOrganizationPreferences = async (\n organizationId: string,\n ): Promise<OrganizationContext['preferences'] \| undefined> => {\n if (!organizationPreferencesOperationPath) return undefined;\n try {\n return await doOperation<NonNullable<OrganizationContext['preferences']>>(\n organizationPreferencesOperationPath,\n { contextualParameters: { organizationId } },\n ) ?? undefined;\n } catch (error) {\n logger.warn('Failed to fetch organization preferences', { organizationId, error });\n return undefined;\n }\n };\n\n const orgPromises = memberships.map(async (membership: any) => {\n try {\n const [org, preferences] = await Promise.all([\n doOperation<OrganizationContext>(\n organizationsOperationPath,\n { contextualParameters: { organizationId: membership.organizationId } }),\n fetchOrganizationPreferences(membership.organizationId),\n ]);\n\n if (!org) return null;\n // OMIT the key when the read failed rather than attaching `null`. The payload builder\n // reads the two differently: `undefined`/absent contributes nothing to the i18n event,\n // while `null` means \"the tenant has cleared its preferences\" and actively resets the\n // organisation half — which would silently downgrade a member to the framework floor\n // because one request failed.\n return preferences ? { ...org, preferences } : org;\n } catch (error) {\n logger.warn('Failed to fetch organization', { organizationId: membership.organizationId, error });\n return null;\n }\n });\n\n const orgResults = await Promise.all(orgPromises);\n organizationsList.push(...orgResults.filter((org): org is OrganizationContext => org !== null));\n }\n\n // Restore current organization selection\n const storedOrgId = tokenStorage.getOrganizationId();\n const selectedOrgId = storedOrgId && organizationsList.find(o => o._id === storedOrgId)\n ? storedOrgId\n : organizationsList[0]?._id \|\| null;\n\n // Compute effective permissions from roles\n const computedPermissions = computeEffectivePermissions(userContext, organizationsList);\n\n setOrganizations(organizationsList);\n commitOrganizationScopeValue(selectedOrgId);\n setPermissions(computedPermissions);\n\n logDebug('Organizations loaded', { organizationCount: organizationsList.length, currentOrganizationId: selectedOrgId });\n return { organizationsList, selectedOrgId };\n }, [commitOrganizationScopeValue, doOperation, registry, tokenStorage, auth.sessionType]);\n\n /\n Restore regular user session\n /\n const restoreUserSession = useCallback(async (accessToken: string): Promise<boolean> => {\n logDebug('Restoring user session');\n\n // Check if USER_SELF is available\n const availableResources = Object.keys(registry.resourceConfigurations);\n const hasUserSelf = availableResources.includes(CoreResourceType.USER_SELF);\n\n if (!hasUserSelf) {\n logger.warn('USER_SELF resource not available for session restoration');\n return false;\n }\n\n // Get USER_SELF resource config\n const userSelfConfig = registry.resourceConfigurations[CoreResourceType.USER_SELF];\n\n const readOperation = userSelfConfig?.operations?.find((op: any) =>\n op.operationIdentifier === CoreResourceOperation.READ &&\n op.isOperationDefault === true &&\n op.isBulkOperation !== true &&\n (\n op.variantType === ResourceOperationVariantType.API_CALL \|\|\n op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n )\n );\n\n if (!readOperation) {\n logger.warn('USER_SELF READ operation not found');\n return false;\n }\n\n // Find context variant (auto-generated with relationship population)\n const readContextOp = userSelfConfig.operations.find((op: any) =>\n op.operationIdentifier === CoreResourceOperation.READ &&\n op.isBulkOperation !== true &&\n (\n op.variantType === ResourceOperationVariantType.API_CALL \|\|\n op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n ) &&\n op.variantKey === OPERATION_VARIANT_KEY.CONTEXT\n );\n\n if (!readContextOp) {\n logger.warn('USER_SELF context variant not found');\n return false;\n }\n\n const initiatorInfo = readOperation.initiatorInfos?.[0];\n const requiresUserId = initiatorInfo?.parameters?.some((p: any) => p.fieldIdentifier === 'userId');\n\n const contextualParameters: Record<string, string> = {};\n\n if (requiresUserId && accessToken) {\n try {\n const payload = decodeJwtPayload<{ userId?: string }>(accessToken);\n if (payload.userId) {\n contextualParameters.userId = payload.userId;\n }\n } catch (e) {\n logDebug('Failed to decode JWT for userId extraction', { error: e });\n }\n }\n\n // Build operation path and fetch user context\n const contextPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readContextOp);\n const userContext = await doOperation<UserContext>(contextPath, { contextualParameters });\n\n if (!userContext) {\n logger.warn('Failed to fetch user context during session restoration');\n return false;\n }\n\n // Use new field name from relationship-based context\n const membershipsCount = (userContext.organizationMembers \|\| []).length;\n logDebug('User context restored', { userId: userContext._id, organizationCount: membershipsCount });\n\n // Update user state\n setUser(userContext);\n\n // Load organizations separately\n // If this fails, session restoration still succeeds (user context is restored)\n const { organizationsList, selectedOrgId } = await loadOrganizations(userContext);\n\n // Store preferences after organization loading so i18n receives user and\n // active-organization language policy in the same event.\n const preferences = userContext.userSelfPreferences;\n if (preferences) {\n const currentOrganization = selectedOrgId\n ? organizationsList.find((organization) => organization._id === selectedOrgId)\n : null;\n storePreferences(preferences, currentOrganization?.preferences);\n }\n\n logger.info('Session restored successfully', {\n userId: userContext._id,\n organizationCount: membershipsCount\n });\n\n return true;\n }, [doOperation, registry, loadOrganizations, storePreferences]);\n\n // Stop any pending restore-retry backoff when the provider unmounts, so the\n // loop in `restoreSession` bails instead of calling setState on a dead tree.\n useEffect(() => {\n restoreAbortRef.current = false;\n return () => {\n restoreAbortRef.current = true;\n if (restoreRetryTimerRef.current) {\n clearTimeout(restoreRetryTimerRef.current);\n restoreRetryTimerRef.current = null;\n }\n };\n }, []);\n\n /\n Restore session from stored JWT token\n * Fetches user context using USER_SELF resource (userId comes from JWT)\n * Then fetches full organization details for each organization membership\n \n Resilience: a TRANSIENT backend failure (unreachable / 5xx / timeout, or a\n * 401 whose in-flight renewal failed transiently) does NOT log out — restore\n * preserves the session and retries with capped exponential backoff until the\n * backend returns. Genuine authentication (401), authorization (403), and\n * non-network errors terminate immediately (no retry on a dead-or-buggy path).\n /\n const restoreSession = useCallback(async (): Promise<boolean> => {\n logDebug('Restoring session from stored token');\n\n // Check if session is already restored to avoid duplicate restoration attempts\n if (auth.sessionRestored && auth.accessToken && user) {\n logDebug('Session already restored, skipping restoration');\n return true;\n }\n\n // Read token from auth state\n const accessToken = auth.accessToken;\n\n if (!accessToken) {\n logDebug('No access token available');\n return false;\n }\n\n setSessionRestoring(true);\n\n let attempt = 0;\n // Single backoff loop: the invoking effect won't re-enter while\n // `isRestoringSession` is true, so this is the sole restore in flight.\n while (true) {\n try {\n const restored = await restoreUserSession(accessToken);\n\n if (restored) {\n markSessionRestored();\n\n // W7.3b: One-off sessions already connected WebSocket in handleOneOffTokenExchange\n // (with consumableToken). Reconnecting here would lose the consumable token.\n if (auth.sessionType !== SessionType.ONE_OFF) {\n // Connect with the FRESHEST token, read live from storage — NOT the\n // `accessToken` captured at the top of `restoreSession`. During the\n // awaited `restoreUserSession` above, the HTTP interceptor may have\n // hit a `401 OUTDATED_AUTH_JWT` and rotated the token via\n // `tokenRenewalHandler` (which writes the new token to storage AND\n // seeds the WS `authStateRef` synchronously). The captured\n // `accessToken` is then stale/expired; passing it into `connect()`\n // reseeds the WS credential source-of-truth back to the expired token\n // (clobbering the fresh one the refresh just stored), and the Socket.IO\n // handshake gets rejected with \"Authentication failed\". `getAccessToken()`\n // returns the live, post-refresh value (falling back to the captured\n // token only if storage is somehow empty).\n const freshestAccessToken = tokenStorage.getAccessToken() ?? accessToken;\n connectWebSocket(freshestAccessToken, tokenStorage.getOrganizationId());\n }\n } else {\n logger.warn('Session restoration could not build a valid authenticated context; logging out to avoid a half-restored state');\n authLogout();\n }\n\n return restored;\n\n } catch (error: any) {\n // Authorization (403 / scope) is checked FIRST and is non-destructive: a\n // permission denial must NEVER destroy a valid session. Authentication\n // (401 / session-invalid) is the only branch that force-logs-out.\n // `isAuthenticationError` already excludes authorization errors (see\n // `AuthSessionUtils`), so these are mutually exclusive — the explicit\n // ordering here is defense-in-depth so the non-destructive path wins even\n // if that guard is ever loosened.\n const isAuthorizationError = AuthSessionUtils.isAuthorizationError(error);\n\n if (isAuthorizationError) {\n const errorMessage = error?.message \|\| 'Session restoration blocked by authorization';\n logger.warn('Session restoration encountered authorization/scope error', {\n error: errorMessage,\n errorType: error?.wildoError?.type \|\| error?.response?.data?.error?.type,\n status: error?.response?.status,\n });\n setSessionRestoring(false);\n markSessionRestored();\n return false;\n }\n\n // TRANSIENT backend failure (checked BEFORE the authentication branch so\n // a 401 whose renewal failed transiently is retried, not logged out):\n // preserve the session, back off, and retry. Bail if the component\n // unmounted or the session was cleared (logout elsewhere) while waiting.\n if (isTransientBackendFailure(error)) {\n attempt += 1;\n const delay = Math.min(\n RESTORE_RETRY_BASE_DELAY_MS 2 (attempt - 1),\n RESTORE_RETRY_MAX_DELAY_MS,\n );\n logger.warn('Session restoration hit a transient backend failure; preserving session and retrying', {\n attempt,\n retryInMs: delay,\n status: error?.response?.status,\n code: error?.code,\n });\n await new Promise<void>((resolve) => {\n restoreRetryTimerRef.current = setTimeout(resolve, delay);\n });\n if (restoreAbortRef.current \|\| !tokenStorage.getAccessToken()) {\n setSessionRestoring(false);\n return false;\n }\n continue;\n }\n\n if (AuthSessionUtils.isAuthenticationError(error)) {\n logDebug('Session restoration failed due to authentication error', {\n errorType: error?.wildoError?.type \|\| error?.response?.data?.error?.type,\n status: error?.response?.status,\n });\n authLogout();\n return false;\n }\n\n // Fail closed on unexpected NON-transient errors. A partially restored\n // authenticated shell is less safe than dropping back to a clean login.\n const errorMessage = error?.message \|\| 'Session restoration failed';\n logger.warn('Session restoration encountered a non-transient error; logging out', {\n error: errorMessage,\n errorType: error?.wildoError?.type,\n });\n\n authLogout();\n return false;\n }\n }\n }, [\n restoreUserSession,\n auth.sessionRestored,\n auth.sessionType,\n auth.accessToken,\n user,\n authLogout,\n markSessionRestored,\n setSessionRestoring,\n connectWebSocket,\n tokenStorage\n ]);\n\n /\n * Refresh organizations data (e.g., after organization update)\n /\n const refreshOrganizations = useCallback(async (): Promise<void> => {\n // Use new field name from relationship-based context\n const memberships = user?.organizationMembers \|\| [];\n\n if (memberships.length === 0) {\n logDebug('No organizations membership to refresh');\n return;\n }\n\n logDebug('Refreshing organizations', { membershipCount: memberships.length });\n\n // Use loadOrganizations to refresh\n await loadOrganizations(user!);\n }, [user, loadOrganizations]);\n\n useEffect(() => {\n if (!user?.userSelfPreferences) {\n return;\n }\n\n const currentOrganization = currentOrganizationId\n ? organizations.find((organization) => organization._id === currentOrganizationId)\n : null;\n\n emitPreferencesChanged(\n user.userSelfPreferences,\n currentOrganization?.preferences,\n );\n }, [currentOrganizationId, emitPreferencesChanged, organizations, user]);\n\n /\n Set the current active organization\n /\n const setCurrentOrganization = useCallback((organizationId: string): void => {\n // Validate that organization exists in user's organizations\n const org = organizations.find(o => o._id === organizationId);\n if (!org) {\n logger.warn('Attempted to set invalid organization', { organizationId, availableOrganizations: organizations.map(o => o._id) });\n return;\n }\n\n const previousOrganizationId = currentOrganizationId;\n\n // Skip if the organization hasn't changed\n if (previousOrganizationId === organizationId) {\n return;\n }\n\n logDebug('Setting current organization', { organizationId, organizationName: org.name, previousOrganizationId });\n commitOrganizationScopeValue(organizationId);\n }, [organizations, currentOrganizationId, commitOrganizationScopeValue]);\n\n /\n Get the current active organization\n /\n const getCurrentOrganization = useCallback((): OrganizationContext \| null => {\n if (!currentOrganizationId) {\n return null;\n }\n return organizations.find(o => o._id === currentOrganizationId) \|\| null;\n }, [currentOrganizationId, organizations]);\n\n /\n Get privacy preferences\n /\n const getPrivacy = useCallback((): UserPrivacy \| null => {\n return privacy;\n }, [privacy]);\n\n /\n Logout wrapper that also clears user/org data\n */\n const logout = useCallback((): void => {\n logDebug('Logging out user', { userId: user?._id, organizationId: currentOrganizationId });\n\n // Clear user/org data first\n setUser(null);\n setOrganizations([]);\n commitOrganizationScopeValue(null);\n setPermissions(null);\n setPrivacy(null);\n emitPreferencesChanged(null);\n\n // Reset initialization flag\n hasInitializedRef.current = false;\n previousTokenRef.current = null;\n\n // Call auth logout (clears tokens, disconnects WebSocket)\n authLogout();\n }, [user?._id, currentOrganizationId, authLogout, commitOrganizationScopeValue, emitPreferencesChanged]);\n\n // Auto-load user/org data when token becomes available\n useEffect(() => {\n const accessToken = auth.accessToken;\n\n // Skip if no token or token hasn't changed\n if (!accessToken \|\| accessToken === previousTokenRef.current) {\n return;\n }\n\n // Skip if session is already restored with this token\n if (auth.sessionRestored && user) {\n previousTokenRef.current = accessToken;\n return;\n }\n\n // Skip if already initializing\n if (hasInitializedRef.current && auth.isRestoringSession) {\n return;\n }\n\n logDebug('Token changed, initiating session restoration', {\n hasToken: !!accessToken,\n previousToken: !!previousTokenRef.current\n });\n\n previousTokenRef.current = accessToken;\n hasInitializedRef.current = true;\n\n // Restore session (will fetch user/org data)\n restoreSession().catch((error) => {\n logger.error('Session restoration failed', { error });\n });\n }, [auth.accessToken, auth.sessionRestored, auth.isRestoringSession, user, restoreSession]);\n\n // Clear data when token is removed (logged out)\n useEffect(() => {\n if (!auth.accessToken && previousTokenRef.current) {\n logDebug('Token removed, clearing user/org data');\n setUser(null);\n setOrganizations([]);\n commitOrganizationScopeValue(null);\n setPermissions(null);\n setPrivacy(null);\n emitPreferencesChanged(null);\n previousTokenRef.current = null;\n hasInitializedRef.current = false;\n }\n }, [auth.accessToken, commitOrganizationScopeValue, emitPreferencesChanged]);\n\n const value = useMemo<UserOrgsContextType>(() => ({\n // Re-exported from AuthSession for backward compatibility\n auth,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout,\n restoreSession,\n\n // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n initiateOAuth2Login,\n handleAuthCodeExchange,\n\n // User data\n user,\n\n // Organization data\n organizations,\n currentOrganizationId,\n permissions,\n primaryScopeInitiatorIds,\n\n // Privacy (only preference managed here)\n privacy,\n\n // Organization management\n setCurrentOrganization,\n getCurrentOrganization,\n refreshOrganizations,\n\n // Privacy getter\n getPrivacy,\n }), [\n auth,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout,\n restoreSession,\n initiateOAuth2Login,\n handleAuthCodeExchange,\n user,\n organizations,\n currentOrganizationId,\n permissions,\n primaryScopeInitiatorIds,\n privacy,\n setCurrentOrganization,\n getCurrentOrganization,\n refreshOrganizations,\n getPrivacy,\n ]);\n\n return <UserOrgsContext.Provider value={value}>{children}</UserOrgsContext.Provider>;\n};\n\n// useUserOrgs hook is now in separate file: ./useUserOrgs.ts\n// This separation is required for React Fast Refresh compatibility\n"]}
1	+ {"version":3,"file":"UserOrgsContext.js","sourceRoot":"","sources":["../../../../../src/core/security/UserOrgsContext.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,aAAa,EAAE,QAAQ,EAAa,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC3G,OAAO,EAGL,gBAAgB,EAChB,kCAAkC,EAClC,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EAIrB,WAAW,EACX,wBAAwB,GAEzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,6CAA6C,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAIzF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6DAA6D,CAAC;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AAEzF,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AACxE,MAAM,QAAQ,GAAiE,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;AACrH,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AA2D1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmD,aAAa,CAAkC,SAAS,CAAC,CAAC;AAEzI,MAAM,CAAC,MAAM,gBAAgB,GAAsC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IAClF,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IAE/B,+BAA+B;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,eAAe,EACf,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,MAAM,EAAE,UAAU,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,GAAG,WAAW,CAAC;IAChB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,EAAE,4BAA4B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC/D,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IAE7D,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,gBAAgB,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IACrD,yEAAyE;IACzE,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,oBAAoB,GAAG,MAAM,CAAuC,IAAI,CAAC,CAAC;IAEhF,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAE3D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAwB,EAAE,CAAC,CAAC;IAE9E,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAGpC,IAAI,CAAC,CAAC;IAEhB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAqB,IAAI,CAAC,CAAC;IAIjE;;;;;;;;;OASG;IACH,MAAM,8BAA8B,GAAG,CACrC,uBAA8E,EACrD,EAAE;QAC3B,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,uBAAuB,KAAK,IAAI,EAAE,CAAC;YACrC,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,+BAA+B,EAAE,uBAAuB,CAAC,mBAAmB,IAAI,IAAI;YACpF,+BAA+B,EAAE;gBAC/B,QAAQ,EAAE,uBAAuB,CAAC,QAAQ;gBAC1C,MAAM,EAAE,uBAAuB,CAAC,MAAM;gBACtC,UAAU,EAAE,uBAAuB,CAAC,UAAU;gBAC9C,UAAU,EAAE,uBAAuB,CAAC,UAAU;aAC/C;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,sBAAsB,GAAG,WAAW,CAAC,CACzC,WAAkD,EAClD,uBAAmE,EAC7D,EAAE;QACR,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;gBAC5C,mBAAmB,EAAE,IAAI;gBACzB,+BAA+B,EAAE,IAAI;gBACrC,mBAAmB,EAAE,IAAI;gBACzB,+BAA+B,EAAE,IAAI;gBACrC,wBAAwB,EAAE,IAAI;gBAC9B,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,wBAAwB,EAAE;YAC5C,GAAG,CAAC,WAAW,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnH,GAAG,8BAA8B,CAAC,uBAAuB,CAAC;YAC1D,GAAG,CAAC,WAAW,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,WAAW,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,MAAM,wBAAwB,GAAG,OAAO,CAAuC,GAAG,EAAE;QAClF,OAAO,iBAAiB,CAAC,iBAAiB,CAAC;YACzC,MAAM,EAAE,QAAQ,CAAC,aAAa;YAC9B,cAAc,EAAE,QAAQ,CAAC,qBAAqB;YAC9C,aAAa,EAAE,QAAQ,CAAC,oBAAoB;YAC5C,eAAe,EAAE,QAAQ,CAAC,sBAAsB;SACjD,CAAC,CAAC;IACL,CAAC,EAAE;QACD,QAAQ,CAAC,oBAAoB;QAC7B,QAAQ,CAAC,sBAAsB;QAC/B,QAAQ,CAAC,qBAAqB;QAC9B,QAAQ,CAAC,aAAa;KACvB,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,CACnC,WAA+B,EAC/B,uBAAmE,EAC7D,EAAE;QACR,qCAAqC;QACrC,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,8BAA8B,GAAG,uBAAuB,KAAK,SAAS;YAC1E,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,qBAAqB;gBACrB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,WAAW;gBAC/F,CAAC,CAAC,SAAS,CAAC;QAEhB,yDAAyD;QACzD,sBAAsB,CACpB,WAAW,EACX,8BAA8B,CAC/B,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,CAAC,CAAC,CAAC;IAEnE;;;OAGG;IACH,MAAM,2BAA2B,GAAG,CAClC,WAAwB,EACxB,iBAAwC,EACX,EAAE;QAC/B,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAa,CAAC;QAE1D,kEAAkE;QAClE,qDAAqD;QACrD,MAAM,wBAAwB,GAA6B,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE1D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,wBAAwB,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAa,CAAC;QAC7F,CAAC;QAED,OAAO;YACL,QAAQ;YACR,aAAa,EAAE,wBAAwB;SACxC,CAAC;IACJ,CAAC,CAAC;IAEF;;OAEG;IACH,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAwB,EAGlE,EAAE;QACH,MAAM,cAAc,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAE7D,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;YAC1D,CAAC,CAAC,YAAY,CAAC,iBAAiB,EAAE;YAClC,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,WAAW,GAAG,WAAW;YAC7B,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC;YACrE,CAAC,CAAC,cAAc,CAAC;QAEnB,QAAQ,CAAC,uBAAuB,EAAE;YAChC,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,eAAe,EAAE,WAAW,CAAC,MAAM;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;SACnD,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAA0B,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,mBAAmB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC5F,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;gBACpD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,qFAAqF;YACrF,MAAM,UAAU,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;YAEpE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBACtD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;YAED,MAAM,0BAA0B,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,UAAU,CAAC,CAAC;YAErH;;;;;;;;;;;;;;;;;;;;;;;;;eAyBG;YACH,MAAM,6BAA6B,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;YACjH,MAAM,6BAA6B,GAAG,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;YAEjG,IAAI,CAAC,6BAA6B,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;YAClH,CAAC;YAED,MAAM,oCAAoC,GAAG,6BAA6B;gBACxE,CAAC,CAAC,kCAAkC,CAAC,kCAAkC,CAAC,6BAA6B,CAAC;gBACtG,CAAC,CAAC,IAAI,CAAC;YAET,MAAM,4BAA4B,GAAG,KAAK,EACxC,cAAsB,EACmC,EAAE;gBAC3D,IAAI,CAAC,oCAAoC;oBAAE,OAAO,SAAS,CAAC;gBAC5D,IAAI,CAAC;oBACH,OAAO,MAAM,WAAW,CACtB,oCAAoC,EACpC,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,EAAE,CAC7C,IAAI,SAAS,CAAC;gBACjB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;oBACnF,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAe,EAAE,EAAE;gBAC5D,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBAC3C,WAAW,CACT,0BAA0B,EAC1B,EAAE,oBAAoB,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC1E,4BAA4B,CAAC,UAAU,CAAC,cAAc,CAAC;qBACxD,CAAC,CAAC;oBAEH,IAAI,CAAC,GAAG;wBAAE,OAAO,IAAI,CAAC;oBACtB,sFAAsF;oBACtF,uFAAuF;oBACvF,sFAAsF;oBACtF,qFAAqF;oBACrF,8BAA8B;oBAC9B,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACrD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;oBAClG,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAClD,iBAAiB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAA8B,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC;QAClG,CAAC;QAED,yCAAyC;QACzC,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACrD,MAAM,aAAa,GAAG,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC;YACrF,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;QAEtC,2CAA2C;QAC3C,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAExF,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACpC,4BAA4B,CAAC,aAAa,CAAC,CAAC;QAC5C,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAEpC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC,CAAC;QACxH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC,EAAE,CAAC,4BAA4B,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1F;;OAEG;IACH,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAmB,EAAoB,EAAE;QACrF,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAEnC,kCAAkC;QAClC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAE5E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEnF,MAAM,aAAa,GAAG,2BAA2B,CAAC,cAAc,CAAC,CAAC;QAElE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,MAAM,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAO,EAAE,EAAE,CAC/D,EAAE,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;YACrD,EAAE,CAAC,eAAe,KAAK,IAAI;YAC3B,CACE,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;gBACxD,EAAE,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACvE;YACD,EAAE,CAAC,UAAU,KAAK,qBAAqB,CAAC,OAAO,CAChD,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC;QAEnG,MAAM,oBAAoB,GAA2B,EAAE,CAAC;QAExD,IAAI,cAAc,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,gBAAgB,CAAsB,WAAW,CAAC,CAAC;gBACnE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,oBAAoB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC/C,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,MAAM,WAAW,GAAG,kCAAkC,CAAC,kCAAkC,CAAC,aAAa,CAAC,CAAC;QACzG,MAAM,WAAW,GAAG,MAAM,WAAW,CAAc,WAAW,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,CAAC,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACxE,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEpG,oBAAoB;QACpB,OAAO,CAAC,WAAW,CAAC,CAAC;QAErB,gCAAgC;QAChC,+EAA+E;QAC/E,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAElF,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,mBAAmB,GAAG,aAAa;gBACvC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,aAAa,CAAC;gBAC9E,CAAC,CAAC,IAAI,CAAC;YACT,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YAC3C,MAAM,EAAE,WAAW,CAAC,GAAG;YACvB,iBAAiB,EAAE,gBAAgB;SACpC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,6EAA6E;IAC7E,SAAS,CAAC,GAAG,EAAE;QACb,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,OAAO,GAAG,EAAE;YACV,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,IAAI,oBAAoB,CAAC,OAAO,EAAE,CAAC;gBACjC,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC3C,oBAAoB,CAAC,OAAO,GAAG,IAAI,CAAC;YACtC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;;;;;;;OAUG;IACH,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,IAAsB,EAAE;QAC9D,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAEhD,+EAA+E;QAC/E,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YACrD,QAAQ,CAAC,gDAAgD,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,gEAAgE;QAChE,uEAAuE;QACvE,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;gBAEvD,IAAI,QAAQ,EAAE,CAAC;oBACb,mBAAmB,EAAE,CAAC;oBAEtB,mFAAmF;oBACnF,6EAA6E;oBAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;wBAC7C,oEAAoE;wBACpE,oEAAoE;wBACpE,oEAAoE;wBACpE,0DAA0D;wBAC1D,mEAAmE;wBACnE,2DAA2D;wBAC3D,mEAAmE;wBACnE,sEAAsE;wBACtE,wEAAwE;wBACxE,2EAA2E;wBAC3E,qEAAqE;wBACrE,2CAA2C;wBAC3C,MAAM,mBAAmB,GAAG,YAAY,CAAC,cAAc,EAAE,IAAI,WAAW,CAAC;wBACzE,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC;oBAC1E,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,+GAA+G,CAAC,CAAC;oBAC7H,UAAU,EAAE,CAAC;gBACf,CAAC;gBAED,OAAO,QAAQ,CAAC;YAElB,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,yEAAyE;gBACzE,uEAAuE;gBACvE,kEAAkE;gBAClE,qEAAqE;gBACrE,sEAAsE;gBACtE,0EAA0E;gBAC1E,kCAAkC;gBAClC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAE1E,IAAI,oBAAoB,EAAE,CAAC;oBACzB,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,8CAA8C,CAAC;oBACtF,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;wBACvE,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAC3B,mBAAmB,EAAE,CAAC;oBACtB,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,yEAAyE;gBACzE,sEAAsE;gBACtE,mEAAmE;gBACnE,yEAAyE;gBACzE,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrC,OAAO,IAAI,CAAC,CAAC;oBACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,2BAA2B,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAChD,0BAA0B,CAC3B,CAAC;oBACF,MAAM,CAAC,IAAI,CAAC,sFAAsF,EAAE;wBAClG,OAAO;wBACP,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;wBAC/B,IAAI,EAAE,KAAK,EAAE,IAAI;qBAClB,CAAC,CAAC;oBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;wBAClC,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC5D,CAAC,CAAC,CAAC;oBACH,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;wBAC9D,mBAAmB,CAAC,KAAK,CAAC,CAAC;wBAC3B,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClD,QAAQ,CAAC,wDAAwD,EAAE;wBACjE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI;wBACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;qBAChC,CAAC,CAAC;oBACH,UAAU,EAAE,CAAC;oBACb,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,uEAAuE;gBACvE,wEAAwE;gBACxE,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,IAAI,4BAA4B,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;oBAChF,KAAK,EAAE,YAAY;oBACnB,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI;iBACnC,CAAC,CAAC;gBAEH,UAAU,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC,EAAE;QACD,kBAAkB;QAClB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,WAAW;QAChB,IAAI;QACJ,UAAU;QACV,mBAAmB;QACnB,mBAAmB;QACnB,gBAAgB;QAChB,YAAY;KACb,CAAC,CAAC;IAEH;;OAEG;IACH,MAAM,oBAAoB,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACjE,qDAAqD;QACrD,MAAM,WAAW,GAAG,IAAI,EAAE,mBAAmB,IAAI,EAAE,CAAC;QAEpD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,wCAAwC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,0BAA0B,EAAE,EAAE,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9E,mCAAmC;QACnC,MAAM,iBAAiB,CAAC,IAAK,CAAC,CAAC;IACjC,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE9B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,mBAAmB,GAAG,qBAAqB;YAC/C,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,qBAAqB,CAAC;YAClF,CAAC,CAAC,IAAI,CAAC;QAET,sBAAsB,CACpB,IAAI,CAAC,mBAAmB,EACxB,mBAAmB,EAAE,WAAW,CACjC,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,CAAC,cAAsB,EAAQ,EAAE;QAC1E,4DAA4D;QAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,cAAc,EAAE,sBAAsB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChI,OAAO;QACT,CAAC;QAED,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;QAErD,0CAA0C;QAC1C,IAAI,sBAAsB,KAAK,cAAc,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,8BAA8B,EAAE,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,CAAC,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACjH,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC,EAAE,CAAC,aAAa,EAAE,qBAAqB,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,GAA+B,EAAE;QAC1E,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,qBAAqB,CAAC,IAAI,IAAI,CAAC;IAC1E,CAAC,EAAE,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC,CAAC;IAE3C;;OAEG;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,GAAuB,EAAE;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,2GAA2G;IAC3G,iEAAiE;IACjE,MAAM,8BAA8B,GAAG,QAAQ,CAAC,yBAAyB,CAAC;IAC1E,MAAM,qBAAqB,GAAG,WAAW,CAAC,KAAK,EAAE,eAA0C,EAAwB,EAAE;QACnH,MAAM,SAAS,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,UAAU,CAAC,IAAI,CACxG,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,MAAM;eACxE,SAAS,CAAC,kBAAkB,KAAK,IAAI;eACrC,SAAS,CAAC,eAAe,KAAK,IAAI;eAClC,CACD,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;mBAC5D,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACjF,CACJ,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;QACzH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,kCAAkC,CAAC,kCAAkC,CAAC,SAAS,CAAC,EAChF;YACE,mGAAmG;YACnG,oGAAoG;YACpG,+FAA+F;YAC/F,gGAAgG;YAChG,oBAAoB,EAAE,8BAA8B,EAAE;YACtD,WAAW,EAAE;gBACX,4FAA4F;gBAC5F,OAAO,EAAE,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,eAAe,CAAC,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,EAAE;aACxG;SACF,CACF,CAAC;QACF,MAAM,aAAa,GAAG,OAAO,EAAE,OAAO,CAAC;QACvC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QAED,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,8FAA8F;QAC9F,0FAA0F;QAC1F,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ;YAC5B,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAwC,EAAE;YACjJ,CAAC,CAAC,QAAQ,CAAC,CAAC;QACd,gGAAgG;QAChG,kGAAkG;QAClG,qFAAqF;QACrF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACpD,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1F,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC,EAAE,CAAC,8BAA8B,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAExG;;OAEG;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAS,EAAE;QACpC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAE3F,4BAA4B;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACnC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAE7B,4BAA4B;QAC5B,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QAClC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEhC,0DAA0D;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE,UAAU,EAAE,4BAA4B,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAEzG,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,2CAA2C;QAC3C,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;YACvC,OAAO;QACT,CAAC;QAED,+BAA+B;QAC/B,IAAI,iBAAiB,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,+CAA+C,EAAE;YACxD,QAAQ,EAAE,CAAC,CAAC,WAAW;YACvB,aAAa,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO;SAC1C,CAAC,CAAC;QAEH,gBAAgB,CAAC,OAAO,GAAG,WAAW,CAAC;QACvC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEjC,6CAA6C;QAC7C,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/B,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAE5F,gDAAgD;IAChD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAClD,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,4BAA4B,CAAC,IAAI,CAAC,CAAC;YACnC,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC7B,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QACpC,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,4BAA4B,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,OAAO,CAAsB,GAAG,EAAE,CAAC,CAAC;QAChD,0DAA0D;QAC1D,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QAEd,uEAAuE;QACvE,mBAAmB;QACnB,sBAAsB;QAEtB,YAAY;QACZ,IAAI;QAEJ,oBAAoB;QACpB,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QAExB,yCAAyC;QACzC,OAAO;QAEP,0BAA0B;QAC1B,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QAEpB,iBAAiB;QACjB,UAAU;QACV,qBAAqB;KACtB,CAAC,EAAE;QACF,IAAI;QACJ,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QACN,cAAc;QACd,mBAAmB;QACnB,sBAAsB;QACtB,IAAI;QACJ,aAAa;QACb,qBAAqB;QACrB,WAAW;QACX,wBAAwB;QACxB,OAAO;QACP,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QACpB,UAAU;QACV,qBAAqB;KACtB,CAAC,CAAC;IAEH,OAAO,KAAC,eAAe,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA4B,CAAC;AACvF,CAAC,CAAC","sourcesContent":["import React, { createContext, useState, ReactNode, useMemo, useEffect, useCallback, useRef } from 'react';\nimport {\n UserContext,\n OrganizationContext,\n CoreResourceType,\n ResourcesConfig_OperationPathUtils,\n CoreResourceOperation,\n ResourceOperationVariantType,\n OPERATION_VARIANT_KEY,\n ExecutionContext_InitiatorIds,\n UserPrivacy,\n UserPreferences,\n SessionType,\n normalizeConsentPurposes,\n type ConsentPurpose,\n} from '@wildo-ai/saas-models';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useEventBus } from '~wildo-frontend-lib/core/events/useEventBus';\nimport { FrontendEvents } from '~wildo-frontend-lib/core/events/events.frontend.schemas';\nimport {\n EffectivePermissions,\n} from './security.frontend.schemas';\nimport { useAuthSession } from './useAuthSession';\nimport { AuthSessionUtils } from './auth-session.utils';\nimport { isTransientBackendFailure } from '~wildo-frontend-lib/core/requests/auth-refresh-resilience.frontend';\nimport { decodeJwtPayload } from './jwt.frontend.utils';\nimport { useAppScope } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { useAppScopeInternal } from '~wildo-frontend-lib/core/scope/AppScopeContext';\nimport { ScopeUtilsService } from '~wildo-frontend-lib/core/scope/scope.utils.frontend.service';\nimport { findDefaultApiReadOperation } from './route-organization-access.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\nconst logDebug: (message: string, context?: Record<string, unknown>) => void = logger.debugByType('UserOrgsContext');\nlogger.setDebugTypeLogging('UserOrgsContext', false);\n\n/*\n Session-restore retry backoff bounds (transient backend failures only).\n \n On RELOAD, a backend that is recompiling/restarting (dev) or briefly\n * unavailable (prod) makes the session-restore fetch fail transiently. Rather\n * than force a logout — which clears the shared `__wildo_refresh` cookie and\n * drops the user to the login screen — restore preserves the session and\n * retries with exponential backoff until the backend returns. Genuine auth/authz\n * and non-network errors do NOT retry (see `restoreSession`). Backoff caps so a\n * sustained outage settles at one attempt per {@link RESTORE_RETRY_MAX_DELAY_MS}.\n /\nconst RESTORE_RETRY_BASE_DELAY_MS = 1_000;\nconst RESTORE_RETRY_MAX_DELAY_MS = 30_000;\n\n/\n User Organizations Context\n * Manages user data, organizations, permissions, and preferences\n * Consumes AuthSessionContext for authentication state\n /\n\nexport interface UserOrgsContextType {\n // Re-exported from AuthSession for backward compatibility\n auth: ReturnType<typeof useAuthSession>['auth'];\n identifyByEmail: ReturnType<typeof useAuthSession>['identifyByEmail'];\n authenticateWithPassword: ReturnType<typeof useAuthSession>['authenticateWithPassword'];\n authenticate: ReturnType<typeof useAuthSession>['authenticate'];\n getSessionState: ReturnType<typeof useAuthSession>['getSessionState'];\n isAuthenticated: ReturnType<typeof useAuthSession>['isAuthenticated'];\n logout: () => void;\n restoreSession: () => Promise<boolean>;\n\n // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n initiateOAuth2Login: ReturnType<typeof useAuthSession>['initiateOAuth2Login'];\n handleAuthCodeExchange: ReturnType<typeof useAuthSession>['handleAuthCodeExchange'];\n\n // User data\n user: UserContext \| null;\n\n // Organization data\n organizations: OrganizationContext[];\n currentOrganizationId: string \| null;\n permissions: EffectivePermissions \| null;\n primaryScopeInitiatorIds: ExecutionContext_InitiatorIds \| null;\n\n // Privacy (only preference managed here, others are in their respective contexts)\n privacy: UserPrivacy \| null;\n\n // Organization management\n setCurrentOrganization: (organizationId: string) => void;\n getCurrentOrganization: () => OrganizationContext \| null;\n refreshOrganizations: () => Promise<void>;\n\n // Privacy getter\n getPrivacy: () => UserPrivacy \| null;\n\n /\n Record the signed-in person's consent decision: exactly the purposes they granted (#534).\n \n The argument is the WHOLE granted set, never a delta — a purpose left out is a purpose not granted,\n * so an unticked box is a withdrawal rather than \"no change\". The write always carries a decision\n * claim, which is what lets \"grant nothing\" be recorded as a decision instead of reading as a person\n * who was never asked; the recorded instant is the server's (`buildConsentDecisionPatch`).\n \n Resolves with the stored privacy block once it is in state, so a caller gating on consent (the\n * consent gate) sees the new decision on the next render. Rejects when the application mounts no\n * self-preferences UPDATE door or the write fails — a consent surface must say it could not save,\n * never behave as though it had.\n /\n recordConsentDecision: (grantedPurposes: readonly ConsentPurpose[]) => Promise<UserPrivacy>;\n}\n\n/\n UserOrgs Context\n * Exported for use in separate hook file (Fast Refresh compatibility)\n * @internal - Use useUserOrgs() hook instead of accessing this directly\n /\nexport const UserOrgsContext: React.Context<UserOrgsContextType \| undefined> = createContext<UserOrgsContextType \| undefined>(undefined);\n\nexport const UserOrgsProvider: React.FC<{ children: ReactNode }> = ({ children }) => {\n const { doOperation, registry } = useResourceRegistry();\n const { emit } = useEventBus();\n\n // Consume auth session context\n const authSession = useAuthSession();\n const {\n auth,\n tokenStorage,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout: authLogout,\n initiateOAuth2Login,\n handleAuthCodeExchange,\n markSessionRestored,\n setSessionRestoring,\n connectWebSocket,\n } = authSession;\n const appScope = useAppScope();\n const { commitOrganizationScopeValue } = useAppScopeInternal();\n const currentOrganizationId = appScope.currentOrganizationId;\n\n const hasInitializedRef = useRef(false);\n const previousTokenRef = useRef<string \| null>(null);\n // Restore-retry lifecycle: `restoreAbortRef` flips true on unmount so an\n // in-flight backoff loop bails instead of touching state on a dead component;\n // `restoreRetryTimerRef` holds the pending backoff timer for cleanup.\n const restoreAbortRef = useRef(false);\n const restoreRetryTimerRef = useRef<ReturnType<typeof setTimeout> \| null>(null);\n\n const [user, setUser] = useState<UserContext \| null>(null);\n\n const [organizations, setOrganizations] = useState<OrganizationContext[]>([]);\n\n const [permissions, setPermissions] = useState<{\n appLevel: string[];\n organizations: Record<string, string[]>;\n } \| null>(null);\n\n const [privacy, setPrivacy] = useState<UserPrivacy \| null>(null);\n\n type PreferencesPayload = Pick<UserPreferences, 'languagePreferences' \| 'regional' \| 'ui' \| 'notifications' \| 'privacy'>;\n\n /\n The TENANT's half of the payload, derived from its preferences record rather than passed\n * alongside it (#410).\n \n The organization contributes two things to `I18nContext` — its language policy and its regional\n * defaults — and they are forwarded together because they come from one record. An earlier shape\n * took the language block as its own argument, and when the regional half was added every call\n * site would have had to remember to forward a second one: three sites, one obligation each, and\n * a fourth site tomorrow that forwards neither. Passing the record makes forgetting impossible.\n /\n const organizationPreferencesPayload = (\n organizationPreferences: OrganizationContext['preferences'] \| null \| undefined,\n ): Record<string, unknown> => {\n if (organizationPreferences === undefined) {\n return {};\n }\n if (organizationPreferences === null) {\n return { organizationLanguagePreferences: null, organizationRegionalPreferences: null };\n }\n return {\n organizationLanguagePreferences: organizationPreferences.languagePreferences ?? null,\n organizationRegionalPreferences: {\n timezone: organizationPreferences.timezone,\n locale: organizationPreferences.locale,\n dateFormat: organizationPreferences.dateFormat,\n timeFormat: organizationPreferences.timeFormat,\n },\n };\n };\n\n const emitPreferencesChanged = useCallback((\n preferences: PreferencesPayload \| null \| undefined,\n organizationPreferences?: OrganizationContext['preferences'] \| null,\n ): void => {\n if (preferences === null) {\n emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n languagePreferences: null,\n organizationLanguagePreferences: null,\n regionalPreferences: null,\n organizationRegionalPreferences: null,\n notificationsPreferences: null,\n uiPreferences: null,\n privacy: null,\n });\n return;\n }\n\n emit(FrontendEvents.USER_PREFERENCES_CHANGED, {\n ...(preferences?.languagePreferences !== undefined ? { languagePreferences: preferences.languagePreferences } : {}),\n ...organizationPreferencesPayload(organizationPreferences),\n ...(preferences?.regional !== undefined ? { regionalPreferences: preferences.regional } : {}),\n ...(preferences?.notifications !== undefined ? { notificationsPreferences: preferences.notifications } : {}),\n ...(preferences?.ui !== undefined ? { uiPreferences: preferences.ui } : {}),\n ...(preferences?.privacy !== undefined ? { privacy: preferences.privacy } : {}),\n });\n }, [emit]);\n\n const primaryScopeInitiatorIds = useMemo<ExecutionContext_InitiatorIds \| null>(() => {\n return ScopeUtilsService.buildInitiatorIds({\n userId: appScope.currentUserId,\n organizationId: appScope.currentOrganizationId,\n applicationId: appScope.currentApplicationId,\n anonymousUserId: appScope.currentAnonymousUserId,\n });\n }, [\n appScope.currentApplicationId,\n appScope.currentAnonymousUserId,\n appScope.currentOrganizationId,\n appScope.currentUserId,\n ]);\n\n /\n Extract and store user preferences from context\n * Stores preferences in state for other contexts to read and apply\n /\n const storePreferences = useCallback((\n preferences: PreferencesPayload,\n organizationPreferences?: OrganizationContext['preferences'] \| null,\n ): void => {\n // Store privacy preferences in state\n if (preferences.privacy) {\n setPrivacy(preferences.privacy);\n }\n\n const currentOrganizationPreferences = organizationPreferences !== undefined\n ? organizationPreferences\n : currentOrganizationId\n ? organizations.find((organization) => organization._id === currentOrganizationId)?.preferences\n : undefined;\n\n // Emit preference change event to notify parent contexts\n emitPreferencesChanged(\n preferences,\n currentOrganizationPreferences,\n );\n }, [currentOrganizationId, emitPreferencesChanged, organizations]);\n\n /\n Compute effective permissions from user's app roles and organization roles\n * This is a basic implementation - can be enhanced based on role hierarchy\n /\n const computeEffectivePermissions = (\n userContext: UserContext,\n organizationsList: OrganizationContext[]\n ): EffectivePermissions \| null => {\n // App-level permissions from user's app roles\n const appLevel = (userContext.appRoles \|\| []) as string[];\n\n // Per-organization permissions from organization membership roles\n // Use new field name from relationship-based context\n const organizationsPermissions: Record<string, string[]> = {};\n const memberships = userContext.organizationMembers \|\| [];\n\n for (const membership of memberships) {\n organizationsPermissions[membership.organizationId] = (membership.roles \|\| []) as string[];\n }\n\n return {\n appLevel,\n organizations: organizationsPermissions,\n };\n };\n\n /\n Load organizations independently (can be called separately from authentication)\n /\n const loadOrganizations = useCallback(async (userContext: UserContext): Promise<{\n organizationsList: OrganizationContext[];\n selectedOrgId: string \| null;\n }> => {\n const allMemberships = userContext.organizationMembers \|\| [];\n\n // W7.3b: For one-off sessions, restrict to the scoped organization only\n const scopedOrgId = auth.sessionType === SessionType.ONE_OFF\n ? tokenStorage.getOrganizationId()\n : null;\n\n const memberships = scopedOrgId\n ? allMemberships.filter((m: any) => m.organizationId === scopedOrgId)\n : allMemberships;\n\n logDebug('Loading organizations', {\n userId: userContext._id,\n membershipCount: memberships.length,\n isOneOff: auth.sessionType === SessionType.ONE_OFF,\n });\n\n const organizationsList: OrganizationContext[] = [];\n\n if (memberships.length > 0) {\n const organizationsConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];\n if (!organizationsConfig) {\n logger.warn('ORGANIZATIONS resource not available');\n return { organizationsList, selectedOrgId: null };\n }\n\n // Shared with the route organization-access probe, which must address the same READ.\n const orgsReadOp = findDefaultApiReadOperation(organizationsConfig);\n\n if (!orgsReadOp) {\n logger.warn('ORGANIZATIONS READ operation not found');\n return { organizationsList, selectedOrgId: null };\n }\n\n const organizationsOperationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(orgsReadOp);\n\n /\n The tenant's preference record is fetched SEPARATELY, and that is a decision rather than an\n * omission (#563).\n \n `OrganizationContextSchema` declares `preferences`, and `doOperation<OrganizationContext>`\n * is a CAST — nothing validates the response against it — so the field read as available\n * while no producer existed: the ORGANIZATIONS default READ returns a plain\n * `Organization`, and the organisation's regional block therefore never reached\n * `I18nContext`. Every date and number in every generated application formatted at the\n * framework floor as a result.\n \n The rejected alternative was to switch this call to the ORGANIZATIONS context variant,\n * which does populate the child. Measured against the running stack on 2026-09-10, that\n * response carries every context-enabled child of an organisation — `auditLogs`, `todos`,\n * `tasks`, `knowledgeDocuments`, `organizationMembers`, … — so session restore would pull an\n * unbounded page of tenant data per membership to obtain four regional fields. (#583 has since\n * taken the audit and delivery logs off the context surface and capped every 1:many child at\n * `contextPolicy.limit`, 20 by default. The page is bounded now, but it is still a page of tenant\n * data per membership, so the reasoning stands.) The\n * preference record has its own default READ (`GET /organizations/{id}/organization-preference`,\n * reachable by an ordinary `ORG_MEMBER`), which is one small request with a stable shape.\n \n Best-effort by construction: a tenant whose preferences cannot be read still yields a\n * usable organisation, and `organizationPreferencesPayload(undefined)` then contributes\n * nothing to the i18n event rather than clearing the member's own settings.\n /\n const organizationPreferencesConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES];\n const organizationPreferencesReadOp = findDefaultApiReadOperation(organizationPreferencesConfig);\n\n if (!organizationPreferencesReadOp) {\n logger.warn('ORGANIZATION_PREFERENCES READ operation not found — tenant regional defaults will not be applied');\n }\n\n const organizationPreferencesOperationPath = organizationPreferencesReadOp\n ? ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(organizationPreferencesReadOp)\n : null;\n\n const fetchOrganizationPreferences = async (\n organizationId: string,\n ): Promise<OrganizationContext['preferences'] \| undefined> => {\n if (!organizationPreferencesOperationPath) return undefined;\n try {\n return await doOperation<NonNullable<OrganizationContext['preferences']>>(\n organizationPreferencesOperationPath,\n { contextualParameters: { organizationId } },\n ) ?? undefined;\n } catch (error) {\n logger.warn('Failed to fetch organization preferences', { organizationId, error });\n return undefined;\n }\n };\n\n const orgPromises = memberships.map(async (membership: any) => {\n try {\n const [org, preferences] = await Promise.all([\n doOperation<OrganizationContext>(\n organizationsOperationPath,\n { contextualParameters: { organizationId: membership.organizationId } }),\n fetchOrganizationPreferences(membership.organizationId),\n ]);\n\n if (!org) return null;\n // OMIT the key when the read failed rather than attaching `null`. The payload builder\n // reads the two differently: `undefined`/absent contributes nothing to the i18n event,\n // while `null` means \"the tenant has cleared its preferences\" and actively resets the\n // organisation half — which would silently downgrade a member to the framework floor\n // because one request failed.\n return preferences ? { ...org, preferences } : org;\n } catch (error) {\n logger.warn('Failed to fetch organization', { organizationId: membership.organizationId, error });\n return null;\n }\n });\n\n const orgResults = await Promise.all(orgPromises);\n organizationsList.push(...orgResults.filter((org): org is OrganizationContext => org !== null));\n }\n\n // Restore current organization selection\n const storedOrgId = tokenStorage.getOrganizationId();\n const selectedOrgId = storedOrgId && organizationsList.find(o => o._id === storedOrgId)\n ? storedOrgId\n : organizationsList[0]?._id \|\| null;\n\n // Compute effective permissions from roles\n const computedPermissions = computeEffectivePermissions(userContext, organizationsList);\n\n setOrganizations(organizationsList);\n commitOrganizationScopeValue(selectedOrgId);\n setPermissions(computedPermissions);\n\n logDebug('Organizations loaded', { organizationCount: organizationsList.length, currentOrganizationId: selectedOrgId });\n return { organizationsList, selectedOrgId };\n }, [commitOrganizationScopeValue, doOperation, registry, tokenStorage, auth.sessionType]);\n\n /\n Restore regular user session\n /\n const restoreUserSession = useCallback(async (accessToken: string): Promise<boolean> => {\n logDebug('Restoring user session');\n\n // Check if USER_SELF is available\n const availableResources = Object.keys(registry.resourceConfigurations);\n const hasUserSelf = availableResources.includes(CoreResourceType.USER_SELF);\n\n if (!hasUserSelf) {\n logger.warn('USER_SELF resource not available for session restoration');\n return false;\n }\n\n // Get USER_SELF resource config\n const userSelfConfig = registry.resourceConfigurations[CoreResourceType.USER_SELF];\n\n const readOperation = findDefaultApiReadOperation(userSelfConfig);\n\n if (!readOperation) {\n logger.warn('USER_SELF READ operation not found');\n return false;\n }\n\n // Find context variant (auto-generated with relationship population)\n const readContextOp = userSelfConfig.operations.find((op: any) =>\n op.operationIdentifier === CoreResourceOperation.READ &&\n op.isBulkOperation !== true &&\n (\n op.variantType === ResourceOperationVariantType.API_CALL \|\|\n op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n ) &&\n op.variantKey === OPERATION_VARIANT_KEY.CONTEXT\n );\n\n if (!readContextOp) {\n logger.warn('USER_SELF context variant not found');\n return false;\n }\n\n const initiatorInfo = readOperation.initiatorInfos?.[0];\n const requiresUserId = initiatorInfo?.parameters?.some((p: any) => p.fieldIdentifier === 'userId');\n\n const contextualParameters: Record<string, string> = {};\n\n if (requiresUserId && accessToken) {\n try {\n const payload = decodeJwtPayload<{ userId?: string }>(accessToken);\n if (payload.userId) {\n contextualParameters.userId = payload.userId;\n }\n } catch (e) {\n logDebug('Failed to decode JWT for userId extraction', { error: e });\n }\n }\n\n // Build operation path and fetch user context\n const contextPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readContextOp);\n const userContext = await doOperation<UserContext>(contextPath, { contextualParameters });\n\n if (!userContext) {\n logger.warn('Failed to fetch user context during session restoration');\n return false;\n }\n\n // Use new field name from relationship-based context\n const membershipsCount = (userContext.organizationMembers \|\| []).length;\n logDebug('User context restored', { userId: userContext._id, organizationCount: membershipsCount });\n\n // Update user state\n setUser(userContext);\n\n // Load organizations separately\n // If this fails, session restoration still succeeds (user context is restored)\n const { organizationsList, selectedOrgId } = await loadOrganizations(userContext);\n\n // Store preferences after organization loading so i18n receives user and\n // active-organization language policy in the same event.\n const preferences = userContext.userSelfPreferences;\n if (preferences) {\n const currentOrganization = selectedOrgId\n ? organizationsList.find((organization) => organization._id === selectedOrgId)\n : null;\n storePreferences(preferences, currentOrganization?.preferences);\n }\n\n logger.info('Session restored successfully', {\n userId: userContext._id,\n organizationCount: membershipsCount\n });\n\n return true;\n }, [doOperation, registry, loadOrganizations, storePreferences]);\n\n // Stop any pending restore-retry backoff when the provider unmounts, so the\n // loop in `restoreSession` bails instead of calling setState on a dead tree.\n useEffect(() => {\n restoreAbortRef.current = false;\n return () => {\n restoreAbortRef.current = true;\n if (restoreRetryTimerRef.current) {\n clearTimeout(restoreRetryTimerRef.current);\n restoreRetryTimerRef.current = null;\n }\n };\n }, []);\n\n /\n Restore session from stored JWT token\n * Fetches user context using USER_SELF resource (userId comes from JWT)\n * Then fetches full organization details for each organization membership\n \n Resilience: a TRANSIENT backend failure (unreachable / 5xx / timeout, or a\n * 401 whose in-flight renewal failed transiently) does NOT log out — restore\n * preserves the session and retries with capped exponential backoff until the\n * backend returns. Genuine authentication (401), authorization (403), and\n * non-network errors terminate immediately (no retry on a dead-or-buggy path).\n /\n const restoreSession = useCallback(async (): Promise<boolean> => {\n logDebug('Restoring session from stored token');\n\n // Check if session is already restored to avoid duplicate restoration attempts\n if (auth.sessionRestored && auth.accessToken && user) {\n logDebug('Session already restored, skipping restoration');\n return true;\n }\n\n // Read token from auth state\n const accessToken = auth.accessToken;\n\n if (!accessToken) {\n logDebug('No access token available');\n return false;\n }\n\n setSessionRestoring(true);\n\n let attempt = 0;\n // Single backoff loop: the invoking effect won't re-enter while\n // `isRestoringSession` is true, so this is the sole restore in flight.\n while (true) {\n try {\n const restored = await restoreUserSession(accessToken);\n\n if (restored) {\n markSessionRestored();\n\n // W7.3b: One-off sessions already connected WebSocket in handleOneOffTokenExchange\n // (with consumableToken). Reconnecting here would lose the consumable token.\n if (auth.sessionType !== SessionType.ONE_OFF) {\n // Connect with the FRESHEST token, read live from storage — NOT the\n // `accessToken` captured at the top of `restoreSession`. During the\n // awaited `restoreUserSession` above, the HTTP interceptor may have\n // hit a `401 OUTDATED_AUTH_JWT` and rotated the token via\n // `tokenRenewalHandler` (which writes the new token to storage AND\n // seeds the WS `authStateRef` synchronously). The captured\n // `accessToken` is then stale/expired; passing it into `connect()`\n // reseeds the WS credential source-of-truth back to the expired token\n // (clobbering the fresh one the refresh just stored), and the Socket.IO\n // handshake gets rejected with \"Authentication failed\". `getAccessToken()`\n // returns the live, post-refresh value (falling back to the captured\n // token only if storage is somehow empty).\n const freshestAccessToken = tokenStorage.getAccessToken() ?? accessToken;\n connectWebSocket(freshestAccessToken, tokenStorage.getOrganizationId());\n }\n } else {\n logger.warn('Session restoration could not build a valid authenticated context; logging out to avoid a half-restored state');\n authLogout();\n }\n\n return restored;\n\n } catch (error: any) {\n // Authorization (403 / scope) is checked FIRST and is non-destructive: a\n // permission denial must NEVER destroy a valid session. Authentication\n // (401 / session-invalid) is the only branch that force-logs-out.\n // `isAuthenticationError` already excludes authorization errors (see\n // `AuthSessionUtils`), so these are mutually exclusive — the explicit\n // ordering here is defense-in-depth so the non-destructive path wins even\n // if that guard is ever loosened.\n const isAuthorizationError = AuthSessionUtils.isAuthorizationError(error);\n\n if (isAuthorizationError) {\n const errorMessage = error?.message \|\| 'Session restoration blocked by authorization';\n logger.warn('Session restoration encountered authorization/scope error', {\n error: errorMessage,\n errorType: error?.wildoError?.type \|\| error?.response?.data?.error?.type,\n status: error?.response?.status,\n });\n setSessionRestoring(false);\n markSessionRestored();\n return false;\n }\n\n // TRANSIENT backend failure (checked BEFORE the authentication branch so\n // a 401 whose renewal failed transiently is retried, not logged out):\n // preserve the session, back off, and retry. Bail if the component\n // unmounted or the session was cleared (logout elsewhere) while waiting.\n if (isTransientBackendFailure(error)) {\n attempt += 1;\n const delay = Math.min(\n RESTORE_RETRY_BASE_DELAY_MS 2 (attempt - 1),\n RESTORE_RETRY_MAX_DELAY_MS,\n );\n logger.warn('Session restoration hit a transient backend failure; preserving session and retrying', {\n attempt,\n retryInMs: delay,\n status: error?.response?.status,\n code: error?.code,\n });\n await new Promise<void>((resolve) => {\n restoreRetryTimerRef.current = setTimeout(resolve, delay);\n });\n if (restoreAbortRef.current \|\| !tokenStorage.getAccessToken()) {\n setSessionRestoring(false);\n return false;\n }\n continue;\n }\n\n if (AuthSessionUtils.isAuthenticationError(error)) {\n logDebug('Session restoration failed due to authentication error', {\n errorType: error?.wildoError?.type \|\| error?.response?.data?.error?.type,\n status: error?.response?.status,\n });\n authLogout();\n return false;\n }\n\n // Fail closed on unexpected NON-transient errors. A partially restored\n // authenticated shell is less safe than dropping back to a clean login.\n const errorMessage = error?.message \|\| 'Session restoration failed';\n logger.warn('Session restoration encountered a non-transient error; logging out', {\n error: errorMessage,\n errorType: error?.wildoError?.type,\n });\n\n authLogout();\n return false;\n }\n }\n }, [\n restoreUserSession,\n auth.sessionRestored,\n auth.sessionType,\n auth.accessToken,\n user,\n authLogout,\n markSessionRestored,\n setSessionRestoring,\n connectWebSocket,\n tokenStorage\n ]);\n\n /\n * Refresh organizations data (e.g., after organization update)\n /\n const refreshOrganizations = useCallback(async (): Promise<void> => {\n // Use new field name from relationship-based context\n const memberships = user?.organizationMembers \|\| [];\n\n if (memberships.length === 0) {\n logDebug('No organizations membership to refresh');\n return;\n }\n\n logDebug('Refreshing organizations', { membershipCount: memberships.length });\n\n // Use loadOrganizations to refresh\n await loadOrganizations(user!);\n }, [user, loadOrganizations]);\n\n useEffect(() => {\n if (!user?.userSelfPreferences) {\n return;\n }\n\n const currentOrganization = currentOrganizationId\n ? organizations.find((organization) => organization._id === currentOrganizationId)\n : null;\n\n emitPreferencesChanged(\n user.userSelfPreferences,\n currentOrganization?.preferences,\n );\n }, [currentOrganizationId, emitPreferencesChanged, organizations, user]);\n\n /\n Set the current active organization\n /\n const setCurrentOrganization = useCallback((organizationId: string): void => {\n // Validate that organization exists in user's organizations\n const org = organizations.find(o => o._id === organizationId);\n if (!org) {\n logger.warn('Attempted to set invalid organization', { organizationId, availableOrganizations: organizations.map(o => o._id) });\n return;\n }\n\n const previousOrganizationId = currentOrganizationId;\n\n // Skip if the organization hasn't changed\n if (previousOrganizationId === organizationId) {\n return;\n }\n\n logDebug('Setting current organization', { organizationId, organizationName: org.name, previousOrganizationId });\n commitOrganizationScopeValue(organizationId);\n }, [organizations, currentOrganizationId, commitOrganizationScopeValue]);\n\n /\n Get the current active organization\n /\n const getCurrentOrganization = useCallback((): OrganizationContext \| null => {\n if (!currentOrganizationId) {\n return null;\n }\n return organizations.find(o => o._id === currentOrganizationId) \|\| null;\n }, [currentOrganizationId, organizations]);\n\n /\n Get privacy preferences\n /\n const getPrivacy = useCallback((): UserPrivacy \| null => {\n return privacy;\n }, [privacy]);\n\n // Depend on the builder alone: the whole AppScope value changes with every custom scope value, and through\n // this callback it would re-render every `useUserOrgs` consumer.\n const buildScopeContextualParameters = appScope.buildContextualParameters;\n const recordConsentDecision = useCallback(async (grantedPurposes: readonly ConsentPurpose[]): Promise<UserPrivacy> => {\n const operation = registry.resourceConfigurations[CoreResourceType.USER_SELF_PREFERENCES]?.operations.find(\n (candidate) => candidate.operationIdentifier === CoreResourceOperation.UPDATE\n && candidate.isOperationDefault === true\n && candidate.isBulkOperation !== true\n && (\n candidate.variantType === ResourceOperationVariantType.API_CALL\n \|\| candidate.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n ),\n );\n if (!operation) {\n throw new Error('Cannot record a consent decision: this application mounts no user self-preferences UPDATE operation');\n }\n\n const updated = await doOperation<UserPreferences>(\n ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(operation),\n {\n // This provider sits ABOVE `ScopedResourceRegistryProvider`, so the `doOperation` it holds injects\n // no scope: the user id the self-preferences route is addressed by has to be supplied here. With an\n // empty set the client could not build the URL and every decision failed before a request left\n // (`frontend_resource_no_endpoint_available`, #977 — found by driving the prompt in a browser).\n contextualParameters: buildScopeContextualParameters(),\n requestData: {\n // The client instant is only a CLAIM that this write is a decision; the server replaces it.\n privacy: { consentedPurposes: normalizeConsentPurposes(grantedPurposes), consentDecidedAt: new Date() },\n },\n },\n );\n const storedPrivacy = updated?.privacy;\n if (!storedPrivacy) {\n throw new Error('Consent decision was written but the response carried no privacy block');\n }\n\n setPrivacy(storedPrivacy);\n // Updating the user's preferences record re-emits USER_PREFERENCES_CHANGED through the effect\n // above, which is how the analytics provider learns the new set without a second channel.\n setUser((previous) => previous\n ? { ...previous, userSelfPreferences: { ...(previous.userSelfPreferences ?? {}), privacy: storedPrivacy } as UserContext['userSelfPreferences'] }\n : previous);\n // While a required purpose was missing the backend refused this person's organization reads, so\n // session restore may have loaded none (#534 re-review N1). Re-load them now that the decision is\n // stored; a failure leaves the decision recorded and is retried on the next restore.\n if (organizations.length === 0) {\n await refreshOrganizations().catch((error: unknown) => {\n logger.warn('Organizations could not be re-loaded after a consent decision', { error });\n });\n }\n return storedPrivacy;\n }, [buildScopeContextualParameters, doOperation, registry, organizations.length, refreshOrganizations]);\n\n /\n Logout wrapper that also clears user/org data\n */\n const logout = useCallback((): void => {\n logDebug('Logging out user', { userId: user?._id, organizationId: currentOrganizationId });\n\n // Clear user/org data first\n setUser(null);\n setOrganizations([]);\n commitOrganizationScopeValue(null);\n setPermissions(null);\n setPrivacy(null);\n emitPreferencesChanged(null);\n\n // Reset initialization flag\n hasInitializedRef.current = false;\n previousTokenRef.current = null;\n\n // Call auth logout (clears tokens, disconnects WebSocket)\n authLogout();\n }, [user?._id, currentOrganizationId, authLogout, commitOrganizationScopeValue, emitPreferencesChanged]);\n\n // Auto-load user/org data when token becomes available\n useEffect(() => {\n const accessToken = auth.accessToken;\n\n // Skip if no token or token hasn't changed\n if (!accessToken \|\| accessToken === previousTokenRef.current) {\n return;\n }\n\n // Skip if session is already restored with this token\n if (auth.sessionRestored && user) {\n previousTokenRef.current = accessToken;\n return;\n }\n\n // Skip if already initializing\n if (hasInitializedRef.current && auth.isRestoringSession) {\n return;\n }\n\n logDebug('Token changed, initiating session restoration', {\n hasToken: !!accessToken,\n previousToken: !!previousTokenRef.current\n });\n\n previousTokenRef.current = accessToken;\n hasInitializedRef.current = true;\n\n // Restore session (will fetch user/org data)\n restoreSession().catch((error) => {\n logger.error('Session restoration failed', { error });\n });\n }, [auth.accessToken, auth.sessionRestored, auth.isRestoringSession, user, restoreSession]);\n\n // Clear data when token is removed (logged out)\n useEffect(() => {\n if (!auth.accessToken && previousTokenRef.current) {\n logDebug('Token removed, clearing user/org data');\n setUser(null);\n setOrganizations([]);\n commitOrganizationScopeValue(null);\n setPermissions(null);\n setPrivacy(null);\n emitPreferencesChanged(null);\n previousTokenRef.current = null;\n hasInitializedRef.current = false;\n }\n }, [auth.accessToken, commitOrganizationScopeValue, emitPreferencesChanged]);\n\n const value = useMemo<UserOrgsContextType>(() => ({\n // Re-exported from AuthSession for backward compatibility\n auth,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout,\n restoreSession,\n\n // OAuth2 + cross-frontend-handoff methods (delegated from AuthSession)\n initiateOAuth2Login,\n handleAuthCodeExchange,\n\n // User data\n user,\n\n // Organization data\n organizations,\n currentOrganizationId,\n permissions,\n primaryScopeInitiatorIds,\n\n // Privacy (only preference managed here)\n privacy,\n\n // Organization management\n setCurrentOrganization,\n getCurrentOrganization,\n refreshOrganizations,\n\n // Privacy getter\n getPrivacy,\n recordConsentDecision,\n }), [\n auth,\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout,\n restoreSession,\n initiateOAuth2Login,\n handleAuthCodeExchange,\n user,\n organizations,\n currentOrganizationId,\n permissions,\n primaryScopeInitiatorIds,\n privacy,\n setCurrentOrganization,\n getCurrentOrganization,\n refreshOrganizations,\n getPrivacy,\n recordConsentDecision,\n ]);\n\n return <UserOrgsContext.Provider value={value}>{children}</UserOrgsContext.Provider>;\n};\n\n// useUserOrgs hook is now in separate file: ./useUserOrgs.ts\n// This separation is required for React Fast Refresh compatibility\n"]}

package/dist/esm/core/security/auth-redirect.frontend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-redirect.frontend.utils.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,yBAAyB,aAAa,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,IAAI,MAAM,CAE5F;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAET;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACxC,MAAM,CAYR;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,MAA8B,GAC3C,MAAM,CAER"}
1	+ {"version":3,"file":"auth-redirect.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,yBAAyB,aAAa,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,IAAI,MAAM,CAE5F;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAET;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACxC,MAAM,CAYR;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,YAAY,GAAE,MAA8B,GAC3C,MAAM,CAER"}

package/dist/esm/core/security/auth-redirect.frontend.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-redirect.frontend.utils.js","sourceRoot":"","sources":["~~../../../../~~src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAEhG,MAAM,CAAC,MAAM,yBAAyB,GAAG,UAAU,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAiC;IACxE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAIvC;IACC,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IAChD,YAAY,CAAC,GAAG,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC1C,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAEnE,OAAO,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,eAAuB,gBAAgB,CAAC,IAAI;IAE5C,OAAO,6BAA6B,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC;AAC/D,CAAC","sourcesContent":["import { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\n\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\n\nexport const AUTH_REDIRECT_QUERY_PARAM = 'redirect';\n\n/*\n Is this a redirect target the app may navigate to after authentication?\n \n ## Why this delegates instead of testing prefixes\n \n The previous implementation was `target.startsWith('/') && !target.startsWith('//')`, and it is\n * worth writing down why that is not a weaker version of the check but a broken one: it tests the\n * bytes a human reads, while the browser navigates to what its URL PARSER produces, and the two\n * disagree on a whole family of inputs. SEVEN shapes passed it and resolved to `https://evil.com/` —\n * `/\\evil.com`, `/\\\\evil.com`, `/\\/evil.com`, and the tab / LF / CR variants that the parser strips\n * before parsing. The measurement and the two parser rules behind it are documented once, at\n * {@link isSameOriginRedirectPath}.\n \n The exploit is post-authentication, which is what makes it worth more than an ordinary open\n * redirect: the user has just proved who they are to a site they trust, and the app hands them to the\n * attacker's origin carrying that established trust.\n \n ## Why the predicate is imported rather than written here\n \n Three other surfaces answer the same question — the one-off-session receiver, the docs-site auth\n * exchange page, and the issuer/receiver schemas in `saas-models` — and on 2026-08-15 all four\n * carried the same hole, because each was a separately hand-written deny-list that \"mirrored\" the\n * others. One importable predicate is what stops the fifth copy from being written.\n */\nexport function isSafeAuthRedirectTarget(target: string \| null \| undefined): target is string {\n return isSameOriginRedirectPath(target);\n}\n\nexport function buildAuthRedirectTarget(params: {\n pathname: string;\n search?: string;\n hash?: string;\n}): string {\n return `${params.pathname}${params.search ?? ''}${params.hash ?? ''}`;\n}\n\nexport function appendAuthRedirectToPath(\n basePath: string,\n redirectTarget: string \| null \| undefined,\n): string {\n if (!isSafeAuthRedirectTarget(redirectTarget)) {\n return basePath;\n }\n\n const [pathAndQuery, hash = ''] = basePath.split('#');\n const [pathname, query = ''] = pathAndQuery.split('?');\n const searchParams = new URLSearchParams(query);\n searchParams.set(AUTH_REDIRECT_QUERY_PARAM, redirectTarget);\n\n const nextQuery = searchParams.toString();\n return `${pathname}${nextQuery ? `?${nextQuery}` : ''}${hash ? `#${hash}` : ''}`;\n}\n\nexport function extractAuthRedirectFromSearch(search: string): string \| undefined {\n const searchParams = new URLSearchParams(search);\n const redirectTarget = searchParams.get(AUTH_REDIRECT_QUERY_PARAM);\n\n return isSafeAuthRedirectTarget(redirectTarget) ? redirectTarget : undefined;\n}\n\nexport function resolvePostAuthRedirect(\n search: string,\n fallbackPath: string = CommonRoutePaths.home,\n): string {\n return extractAuthRedirectFromSearch(search) ?? fallbackPath;\n}\n"]}
1	+ {"version":3,"file":"auth-redirect.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/auth-redirect.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAEhG,MAAM,CAAC,MAAM,yBAAyB,GAAG,UAAU,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAiC;IACxE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAIvC;IACC,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IAChD,YAAY,CAAC,GAAG,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC1C,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAEnE,OAAO,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,eAAuB,gBAAgB,CAAC,IAAI;IAE5C,OAAO,6BAA6B,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC;AAC/D,CAAC","sourcesContent":["import { isSameOriginRedirectPath } from '@wildo-ai/saas-models/public-runtime';\n\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\n\nexport const AUTH_REDIRECT_QUERY_PARAM = 'redirect';\n\n/*\n Is this a redirect target the app may navigate to after authentication?\n \n ## Why this delegates instead of testing prefixes\n \n The previous implementation was `target.startsWith('/') && !target.startsWith('//')`, and it is\n * worth writing down why that is not a weaker version of the check but a broken one: it tests the\n * bytes a human reads, while the browser navigates to what its URL PARSER produces, and the two\n * disagree on a whole family of inputs. SEVEN shapes passed it and resolved to `https://evil.com/` —\n * `/\\evil.com`, `/\\\\evil.com`, `/\\/evil.com`, and the tab / LF / CR variants that the parser strips\n * before parsing. The measurement and the two parser rules behind it are documented once, at\n * {@link isSameOriginRedirectPath}.\n \n The exploit is post-authentication, which is what makes it worth more than an ordinary open\n * redirect: the user has just proved who they are to a site they trust, and the app hands them to the\n * attacker's origin carrying that established trust.\n \n ## Why the predicate is imported rather than written here\n \n Three other surfaces answer the same question — the one-off-session receiver, the docs-site auth\n * exchange page, and the issuer/receiver schemas in `saas-models` — and on 2026-08-15 all four\n * carried the same hole, because each was a separately hand-written deny-list that \"mirrored\" the\n * others. One importable predicate is what stops the fifth copy from being written.\n */\nexport function isSafeAuthRedirectTarget(target: string \| null \| undefined): target is string {\n return isSameOriginRedirectPath(target);\n}\n\nexport function buildAuthRedirectTarget(params: {\n pathname: string;\n search?: string;\n hash?: string;\n}): string {\n return `${params.pathname}${params.search ?? ''}${params.hash ?? ''}`;\n}\n\nexport function appendAuthRedirectToPath(\n basePath: string,\n redirectTarget: string \| null \| undefined,\n): string {\n if (!isSafeAuthRedirectTarget(redirectTarget)) {\n return basePath;\n }\n\n const [pathAndQuery, hash = ''] = basePath.split('#');\n const [pathname, query = ''] = pathAndQuery.split('?');\n const searchParams = new URLSearchParams(query);\n searchParams.set(AUTH_REDIRECT_QUERY_PARAM, redirectTarget);\n\n const nextQuery = searchParams.toString();\n return `${pathname}${nextQuery ? `?${nextQuery}` : ''}${hash ? `#${hash}` : ''}`;\n}\n\nexport function extractAuthRedirectFromSearch(search: string): string \| undefined {\n const searchParams = new URLSearchParams(search);\n const redirectTarget = searchParams.get(AUTH_REDIRECT_QUERY_PARAM);\n\n return isSafeAuthRedirectTarget(redirectTarget) ? redirectTarget : undefined;\n}\n\nexport function resolvePostAuthRedirect(\n search: string,\n fallbackPath: string = CommonRoutePaths.home,\n): string {\n return extractAuthRedirectFromSearch(search) ?? fallbackPath;\n}\n"]}

package/dist/esm/core/security/auth-session.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-session.utils.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/security/auth-session.utils.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,eAAe,EAAE,UAAU,EAAE,CAAC;IAC9B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAkBD;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO;IAEP;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAuCjD;;;OAGG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAiBhD;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAChC,WAAW,EAAE,OAAO,EACpB,mBAAmB,EAAE,UAAU,EAAE,EACjC,2BAA2B,EAAE,UAAU,EAAE,EACzC,oBAAoB,EAAE,UAAU,EAAE,GACjC,yBAAyB;~~CAyC7B~~"}
1	+ {"version":3,"file":"auth-session.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/auth-session.utils.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,eAAe,EAAE,UAAU,EAAE,CAAC;IAC9B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAkBD;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO;IAEP;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAuCjD;;;OAGG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO;IAiBhD;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAChC,WAAW,EAAE,OAAO,EACpB,mBAAmB,EAAE,UAAU,EAAE,EACjC,2BAA2B,EAAE,UAAU,EAAE,EACzC,oBAAoB,EAAE,UAAU,EAAE,GACjC,yBAAyB;CA0D7B"}

package/dist/esm/core/security/auth-session.utils.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { ErrorType, HttpStatusCode, } from '@wildo-ai/saas-models';
-import { ErrorCustomMessageReference } from '@wildo-ai/saas-models';
+import { AuthUtils, ErrorCustomMessageReference } from '@wildo-ai/saas-models';
 const AUTHENTICATION_ERROR_REFERENCES = [
     ErrorCustomMessageReference.AUTHENTICATION,
     ErrorCustomMessageReference.JWT_TOKEN_EXPIRED,
@@ -124,9 +124,26 @@ export class AuthSessionUtils {
         const acceptableSet = acceptableMFAMethods.length > 0
             ? availableMFAMethods.filter((method) => acceptableMFAMethods.includes(method))
             : availableMFAMethods;
-        const enrolledSet = new Set(enrolledSecondFactorMethods);
-        const hasAcceptableEnrollment = acceptableSet.some(m => enrolledSet.has(m));
-        const missingMethods = acceptableSet.filter(m => !enrolledSet.has(m));
+        /*
+         * PRESENTABLE, not enrolled: enrolled ∪ always-available.
+         *
+         * `enrolledSecondFactorMethods` used to carry the always-available factor itself, so this line
+         * read `new Set(enrolledSecondFactorMethods)` and was accidentally right. Once that method
+         * started meaning what its name says — a deliberate setup act, empty when nothing is set up —
+         * this computation had to say out loud which set it wants, or a user whose policy accepts email
+         * OTP would be told to enroll something they do not need.
+         *
+         * The union is done HERE rather than being carried in a new DTO field because the always-
+         * available set is a fact about the VOCABULARY, not about the user: any consumer can derive it
+         * without asking the server, and a field would be a second copy that can go stale.
+         */
+        const presentableSet = new Set([
+            ...enrolledSecondFactorMethods,
+            ...AuthUtils.getAlwaysAvailableSecondFactorMethods(),
+        ]);
+        const hasAcceptableEnrollment = acceptableSet.some(m => presentableSet.has(m));
+        // Always-available factors are never "missing" — there is no setup step to point the user at.
+        const missingMethods = acceptableSet.filter(m => !presentableSet.has(m));
         return {
             isComplete: hasAcceptableEnrollment,
             missingMethods,

package/dist/esm/core/security/auth-session.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-session.utils.js","sourceRoot":"","sources":["../../../../src/core/security/auth-session.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAuB,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAUzF,MAAM,+BAA+B,GAA2C;IAC9E,2BAA2B,CAAC,cAAc;IAC1C,2BAA2B,CAAC,iBAAiB;IAC7C,2BAA2B,CAAC,iBAAiB;IAC7C,2BAA2B,CAAC,mBAAmB;IAC/C,2BAA2B,CAAC,sBAAsB;IAClD,2BAA2B,CAAC,4BAA4B;IACxD,2BAA2B,CAAC,+BAA+B;IAC3D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,kCAAkC;IAC9D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,6BAA6B;IACzD,2BAA2B,CAAC,yCAAyC;CAC7D,CAAC;AAEX;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAC3B,gBAAuB,CAAC;IAExB;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAU;QACrC,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,EAAE,UAA6C,CAAC;QACxE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;gBACtC,IAAI,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,sBAAqD,CAAC,EAAE,CAAC;oBAC/G,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrC,IAAI,MAAM,KAAK,cAAc,CAAC,YAAY,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAC5C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;gBACnB,IAAI,+BAA+B,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAmC,CAAC,EAAE,CAAC;oBAC5F,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAU;QACpC,MAAM,UAAU,GAAG,KAAK,EAAE,UAA6C,CAAC;QACxE,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,cAAc,CAAC,SAAS,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAChC,WAAoB,EACpB,mBAAiC,EACjC,2BAAyC,EACzC,oBAAkC;QAElC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,EAAE;gBAClB,eAAe,EAAE,2BAA2B;gBAC5C,kBAAkB,EAAE,KAAK;aAC1B,CAAC;QACJ,CAAC;QAED,iFAAiF;QACjF,EAAE;QACF,mGAAmG;QACnG,mGAAmG;QACnG,0GAA0G;QAC1G,sGAAsG;QACtG,wGAAwG;QACxG,yGAAyG;QACzG,qGAAqG;QACrG,kCAAkC;QAClC,EAAE;QACF,sGAAsG;QACtG,oGAAoG;QACpG,gGAAgG;QAChG,qBAAqB;QACrB,MAAM,aAAa,GAAiB,oBAAoB,CAAC,MAAM,GAAG,CAAC;YACjE,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/E,CAAC,CAAC,mBAAmB,CAAC;QAExB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzD,MAAM,uBAAuB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5E,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtE,OAAO;YACL,UAAU,EAAE,uBAAuB;YACnC,cAAc;YACd,eAAe,EAAE,2BAA2B;YAC5C,kBAAkB,EAAE,CAAC,uBAAuB;SAC7C,CAAC;IACJ,CAAC;CACF","sourcesContent":["import {\n ErrorType,\n HttpStatusCode,\n} from '@wildo-ai/saas-models';\nimport { WildoError_Frontend, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\nimport type { AuthMethod } from '@wildo-ai/saas-models';\n\nexport interface AccountCompletenessResult {\n isComplete: boolean;\n missingMethods: AuthMethod[];\n enrolledMethods: AuthMethod[];\n requiresEnrollment: boolean;\n}\n\nconst AUTHENTICATION_ERROR_REFERENCES: readonly ErrorCustomMessageReference[] = [\n ErrorCustomMessageReference.AUTHENTICATION,\n ErrorCustomMessageReference.JWT_TOKEN_EXPIRED,\n ErrorCustomMessageReference.JWT_TOKEN_INVALID,\n ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n ErrorCustomMessageReference.JWT_TOKEN_NOT_VERIFIED,\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED,\n ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_AUTHORIZED,\n ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n] as const;\n\n/*\n Static utility class for authentication/session non-component logic.\n /\nexport class AuthSessionUtils {\n private constructor() {}\n\n /\n Check if an error is an AUTHENTICATION (session-invalid) error — i.e. the\n * caller's session/token is missing, expired, or invalid and they must\n * re-authenticate. This drives the session-restore force-logout, so a false\n * positive here logs a perfectly valid session out.\n \n Authentication (401 / session-invalid) and AUTHORIZATION (403 / scope /\n * permission) are DISTINCT axes and are mutually exclusive: a permission\n * denial is NOT a reason to destroy the session. We therefore short-circuit\n * to `false` for any authorization error BEFORE the reference-list check\n * below — this neutralizes `AUTHENTICATION_USER_NOT_AUTHORIZED`, which is\n * semantically an authorization concept that merely lives in the\n * authentication-namespaced `ErrorCustomMessageReference` enum. When it\n * arrives as a 403 (the realistic case) it is an authorization error, full\n * stop, and must not log the user out (recovered 2026-06-29: the\n * session-restore path over-logged-out on scope errors carrying this ref).\n /\n static isAuthenticationError(error: any): boolean {\n if (AuthSessionUtils.isAuthorizationError(error)) {\n return false;\n }\n\n const wildoError = error?.wildoError as WildoError_Frontend \| undefined;\n if (wildoError) {\n if (wildoError.type === ErrorType.AUTHENTICATION) {\n return true;\n }\n if (wildoError.customMessageReference) {\n if (AUTHENTICATION_ERROR_REFERENCES.includes(wildoError.customMessageReference as ErrorCustomMessageReference)) {\n return true;\n }\n }\n }\n\n if (error?.response?.status) {\n const status = error.response.status;\n if (status === HttpStatusCode.UNAUTHORIZED) {\n return true;\n }\n }\n\n if (error?.response?.data?.error) {\n const errorData = error.response.data.error;\n if (errorData.type === ErrorType.AUTHENTICATION) {\n return true;\n }\n if (errorData.code) {\n if (AUTHENTICATION_ERROR_REFERENCES.includes(errorData.code as ErrorCustomMessageReference)) {\n return true;\n }\n }\n }\n\n return false;\n }\n\n /\n Check whether an error represents an authorization/scope problem rather than an\n * invalid or expired authentication session.\n /\n static isAuthorizationError(error: any): boolean {\n const wildoError = error?.wildoError as WildoError_Frontend \| undefined;\n if (wildoError?.type === ErrorType.AUTHORIZATION) {\n return true;\n }\n\n if (error?.response?.status === HttpStatusCode.FORBIDDEN) {\n return true;\n }\n\n if (error?.response?.data?.error?.type === ErrorType.AUTHORIZATION) {\n return true;\n }\n\n return false;\n }\n\n /\n D7: Frontend-only computation. Evaluates whether the user has enrolled sufficient\n * second-factor methods to satisfy the MFA policy.\n \n @param requiresMFA - Backend-computed flag incorporating app-level + org-level policy\n * @param availableMFAMethods - Policy-filtered methods from the auth response\n * @param enrolledSecondFactorMethods - Methods the user has already enrolled\n * @param acceptableMFAMethods - App-config `mfaPolicy.acceptableMFAMethods` (may be empty)\n */\n static evaluateAccountCompleteness(\n requiresMFA: boolean,\n availableMFAMethods: AuthMethod[],\n enrolledSecondFactorMethods: AuthMethod[],\n acceptableMFAMethods: AuthMethod[],\n ): AccountCompletenessResult {\n if (!requiresMFA) {\n return {\n isComplete: true,\n missingMethods: [],\n enrolledMethods: enrolledSecondFactorMethods,\n requiresEnrollment: false,\n };\n }\n\n // `acceptableMFAMethods` NARROWS the policy-derived list — it never replaces it.\n //\n // This mirrors the backend, where `_getAvailableSecondFactorMethods` seeds its candidates from the\n // intrinsic factor map and applies `acceptableMFAMethods` as a FILTER, so app config can only ever\n // subtract methods. Resolving it as a REPLACEMENT here (`acceptable.length > 0 ? acceptable : available`)\n // widened the set back out to raw config, which could name methods that are impossible for this user:\n // an SSO redirect flow (intrinsically FIRST_ONLY — never an MFA ceremony, B-SEC-1) or a method disabled\n // for their user type. `isComplete` was never wrong — it requires an ENROLLED method to match, and those\n // are never enrolled — but `missingMethods` was, so the enrollment UI could instruct a user to enrol\n // something they can never enrol.\n //\n // An EMPTY intersection is honest, not a regression: it means the policy admits no second factor this\n // user could satisfy, which the startup config validator now rejects outright as a deadlock — so it\n // cannot reach production, and surfacing \"enrollment required, nothing offered\" beats naming an\n // impossible method.\n const acceptableSet: AuthMethod[] = acceptableMFAMethods.length > 0\n ? availableMFAMethods.filter((method) => acceptableMFAMethods.includes(method))\n : availableMFAMethods;\n\n const enrolledSet = new Set(enrolledSecondFactorMethods);\n const hasAcceptableEnrollment = acceptableSet.some(m => enrolledSet.has(m));\n\n const missingMethods = acceptableSet.filter(m => !enrolledSet.has(m));\n\n return {\n isComplete: hasAcceptableEnrollment,\n missingMethods,\n enrolledMethods: enrolledSecondFactorMethods,\n requiresEnrollment: !hasAcceptableEnrollment,\n };\n }\n}\n"]}
1	+ {"version":3,"file":"auth-session.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/auth-session.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAuB,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAUpG,MAAM,+BAA+B,GAA2C;IAC9E,2BAA2B,CAAC,cAAc;IAC1C,2BAA2B,CAAC,iBAAiB;IAC7C,2BAA2B,CAAC,iBAAiB;IAC7C,2BAA2B,CAAC,mBAAmB;IAC/C,2BAA2B,CAAC,sBAAsB;IAClD,2BAA2B,CAAC,4BAA4B;IACxD,2BAA2B,CAAC,+BAA+B;IAC3D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,kCAAkC;IAC9D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,6BAA6B;IACzD,2BAA2B,CAAC,yCAAyC;CAC7D,CAAC;AAEX;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAC3B,gBAAuB,CAAC;IAExB;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAU;QACrC,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,EAAE,UAA6C,CAAC;QACxE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;gBACtC,IAAI,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,sBAAqD,CAAC,EAAE,CAAC;oBAC/G,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrC,IAAI,MAAM,KAAK,cAAc,CAAC,YAAY,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAC5C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;gBACnB,IAAI,+BAA+B,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAmC,CAAC,EAAE,CAAC;oBAC5F,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAU;QACpC,MAAM,UAAU,GAAG,KAAK,EAAE,UAA6C,CAAC;QACxE,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,cAAc,CAAC,SAAS,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAChC,WAAoB,EACpB,mBAAiC,EACjC,2BAAyC,EACzC,oBAAkC;QAElC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,EAAE;gBAClB,eAAe,EAAE,2BAA2B;gBAC5C,kBAAkB,EAAE,KAAK;aAC1B,CAAC;QACJ,CAAC;QAED,iFAAiF;QACjF,EAAE;QACF,mGAAmG;QACnG,mGAAmG;QACnG,0GAA0G;QAC1G,sGAAsG;QACtG,wGAAwG;QACxG,yGAAyG;QACzG,qGAAqG;QACrG,kCAAkC;QAClC,EAAE;QACF,sGAAsG;QACtG,oGAAoG;QACpG,gGAAgG;QAChG,qBAAqB;QACrB,MAAM,aAAa,GAAiB,oBAAoB,CAAC,MAAM,GAAG,CAAC;YACjE,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/E,CAAC,CAAC,mBAAmB,CAAC;QAExB;;;;;;;;;;;;WAYG;QACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;YAC7B,GAAG,2BAA2B;YAC9B,GAAG,SAAS,CAAC,qCAAqC,EAAE;SACrD,CAAC,CAAC;QACH,MAAM,uBAAuB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/E,8FAA8F;QAC9F,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzE,OAAO;YACL,UAAU,EAAE,uBAAuB;YACnC,cAAc;YACd,eAAe,EAAE,2BAA2B;YAC5C,kBAAkB,EAAE,CAAC,uBAAuB;SAC7C,CAAC;IACJ,CAAC;CACF","sourcesContent":["import {\n ErrorType,\n HttpStatusCode,\n} from '@wildo-ai/saas-models';\nimport { AuthUtils, WildoError_Frontend, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\nimport type { AuthMethod } from '@wildo-ai/saas-models';\n\nexport interface AccountCompletenessResult {\n isComplete: boolean;\n missingMethods: AuthMethod[];\n enrolledMethods: AuthMethod[];\n requiresEnrollment: boolean;\n}\n\nconst AUTHENTICATION_ERROR_REFERENCES: readonly ErrorCustomMessageReference[] = [\n ErrorCustomMessageReference.AUTHENTICATION,\n ErrorCustomMessageReference.JWT_TOKEN_EXPIRED,\n ErrorCustomMessageReference.JWT_TOKEN_INVALID,\n ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,\n ErrorCustomMessageReference.JWT_TOKEN_NOT_VERIFIED,\n ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,\n ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,\n ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED,\n ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_AUTHORIZED,\n ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,\n ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,\n ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,\n] as const;\n\n/*\n Static utility class for authentication/session non-component logic.\n /\nexport class AuthSessionUtils {\n private constructor() {}\n\n /\n Check if an error is an AUTHENTICATION (session-invalid) error — i.e. the\n * caller's session/token is missing, expired, or invalid and they must\n * re-authenticate. This drives the session-restore force-logout, so a false\n * positive here logs a perfectly valid session out.\n \n Authentication (401 / session-invalid) and AUTHORIZATION (403 / scope /\n * permission) are DISTINCT axes and are mutually exclusive: a permission\n * denial is NOT a reason to destroy the session. We therefore short-circuit\n * to `false` for any authorization error BEFORE the reference-list check\n * below — this neutralizes `AUTHENTICATION_USER_NOT_AUTHORIZED`, which is\n * semantically an authorization concept that merely lives in the\n * authentication-namespaced `ErrorCustomMessageReference` enum. When it\n * arrives as a 403 (the realistic case) it is an authorization error, full\n * stop, and must not log the user out (recovered 2026-06-29: the\n * session-restore path over-logged-out on scope errors carrying this ref).\n /\n static isAuthenticationError(error: any): boolean {\n if (AuthSessionUtils.isAuthorizationError(error)) {\n return false;\n }\n\n const wildoError = error?.wildoError as WildoError_Frontend \| undefined;\n if (wildoError) {\n if (wildoError.type === ErrorType.AUTHENTICATION) {\n return true;\n }\n if (wildoError.customMessageReference) {\n if (AUTHENTICATION_ERROR_REFERENCES.includes(wildoError.customMessageReference as ErrorCustomMessageReference)) {\n return true;\n }\n }\n }\n\n if (error?.response?.status) {\n const status = error.response.status;\n if (status === HttpStatusCode.UNAUTHORIZED) {\n return true;\n }\n }\n\n if (error?.response?.data?.error) {\n const errorData = error.response.data.error;\n if (errorData.type === ErrorType.AUTHENTICATION) {\n return true;\n }\n if (errorData.code) {\n if (AUTHENTICATION_ERROR_REFERENCES.includes(errorData.code as ErrorCustomMessageReference)) {\n return true;\n }\n }\n }\n\n return false;\n }\n\n /\n Check whether an error represents an authorization/scope problem rather than an\n * invalid or expired authentication session.\n /\n static isAuthorizationError(error: any): boolean {\n const wildoError = error?.wildoError as WildoError_Frontend \| undefined;\n if (wildoError?.type === ErrorType.AUTHORIZATION) {\n return true;\n }\n\n if (error?.response?.status === HttpStatusCode.FORBIDDEN) {\n return true;\n }\n\n if (error?.response?.data?.error?.type === ErrorType.AUTHORIZATION) {\n return true;\n }\n\n return false;\n }\n\n /\n D7: Frontend-only computation. Evaluates whether the user has enrolled sufficient\n * second-factor methods to satisfy the MFA policy.\n \n @param requiresMFA - Backend-computed flag incorporating app-level + org-level policy\n * @param availableMFAMethods - Policy-filtered methods from the auth response\n * @param enrolledSecondFactorMethods - Methods the user has already enrolled\n * @param acceptableMFAMethods - App-config `mfaPolicy.acceptableMFAMethods` (may be empty)\n /\n static evaluateAccountCompleteness(\n requiresMFA: boolean,\n availableMFAMethods: AuthMethod[],\n enrolledSecondFactorMethods: AuthMethod[],\n acceptableMFAMethods: AuthMethod[],\n ): AccountCompletenessResult {\n if (!requiresMFA) {\n return {\n isComplete: true,\n missingMethods: [],\n enrolledMethods: enrolledSecondFactorMethods,\n requiresEnrollment: false,\n };\n }\n\n // `acceptableMFAMethods` NARROWS the policy-derived list — it never replaces it.\n //\n // This mirrors the backend, where `_getAvailableSecondFactorMethods` seeds its candidates from the\n // intrinsic factor map and applies `acceptableMFAMethods` as a FILTER, so app config can only ever\n // subtract methods. Resolving it as a REPLACEMENT here (`acceptable.length > 0 ? acceptable : available`)\n // widened the set back out to raw config, which could name methods that are impossible for this user:\n // an SSO redirect flow (intrinsically FIRST_ONLY — never an MFA ceremony, B-SEC-1) or a method disabled\n // for their user type. `isComplete` was never wrong — it requires an ENROLLED method to match, and those\n // are never enrolled — but `missingMethods` was, so the enrollment UI could instruct a user to enrol\n // something they can never enrol.\n //\n // An EMPTY intersection is honest, not a regression: it means the policy admits no second factor this\n // user could satisfy, which the startup config validator now rejects outright as a deadlock — so it\n // cannot reach production, and surfacing \"enrollment required, nothing offered\" beats naming an\n // impossible method.\n const acceptableSet: AuthMethod[] = acceptableMFAMethods.length > 0\n ? availableMFAMethods.filter((method) => acceptableMFAMethods.includes(method))\n : availableMFAMethods;\n\n /\n * PRESENTABLE, not enrolled: enrolled ∪ always-available.\n \n `enrolledSecondFactorMethods` used to carry the always-available factor itself, so this line\n * read `new Set(enrolledSecondFactorMethods)` and was accidentally right. Once that method\n * started meaning what its name says — a deliberate setup act, empty when nothing is set up —\n * this computation had to say out loud which set it wants, or a user whose policy accepts email\n * OTP would be told to enroll something they do not need.\n \n The union is done HERE rather than being carried in a new DTO field because the always-\n * available set is a fact about the VOCABULARY, not about the user: any consumer can derive it\n * without asking the server, and a field would be a second copy that can go stale.\n */\n const presentableSet = new Set([\n ...enrolledSecondFactorMethods,\n ...AuthUtils.getAlwaysAvailableSecondFactorMethods(),\n ]);\n const hasAcceptableEnrollment = acceptableSet.some(m => presentableSet.has(m));\n\n // Always-available factors are never \"missing\" — there is no setup step to point the user at.\n const missingMethods = acceptableSet.filter(m => !presentableSet.has(m));\n\n return {\n isComplete: hasAcceptableEnrollment,\n missingMethods,\n enrolledMethods: enrolledSecondFactorMethods,\n requiresEnrollment: !hasAcceptableEnrollment,\n };\n }\n}\n"]}

package/dist/esm/core/security/consent-gate.frontend.utils.d.ts ADDED Viewed

@@ -0,0 +1,102 @@
+import { ConsentPurpose, type ServiceConsentRequirement } from '@wildo-ai/saas-models';
+/**
+ * What the application-tier consent gate must do for the signed-in person, right now (#534 / #453).
+ *
+ * A closed vocabulary rather than two booleans, because the four states differ in what they do to the
+ * application, and a pair of flags admits a fifth ("blocking AND a prompt") that means nothing.
+ */
+export declare enum ConsentGateStatus {
+    /** The application declares no required purpose and does no consent-based processing. Renders nothing. */
+    NOT_APPLICABLE = "notApplicable",
+    /**
+     * A purpose the application REQUIRES (`compliance.serviceConsentRequirement`) is not granted. The
+     * gate replaces every signed-in route until it is — this is the enforced half of
+     * `operatorComplianceIdentity.serviceConsentRequirement`.
+     */
+    REQUIRED = "required",
+    /**
+     * Nothing is required, but the application does consent-based processing and the person has never
+     * made a decision. A NON-blocking prompt: the application renders beneath it, and the processing
+     * stays off (the analytics provider reads the empty set) until the person grants it.
+     */
+    PROMPT = "prompt",
+    /** Every required purpose is granted, and any optional purpose was decided on. Renders nothing. */
+    SATISFIED = "satisfied"
+}
+export interface ConsentGateInput {
+    /** `compliance.serviceConsentRequirement` — absent means nothing is required. */
+    serviceConsentRequirement: ServiceConsentRequirement | undefined;
+    /** Whether the application runs analytics at all (`analytics.enabled`). */
+    analyticsEnabled: boolean;
+    /** `analytics.requiresConsent` — `false` is a claim analytics here is not consent-based. */
+    analyticsRequiresConsent: boolean;
+    /**
+     * `compliance.capabilityDeclaredConsentPurposes` (#1462) — every purpose declared by at least one
+     * resource operation's `consentGate`, derived by the engine at boot. Absent (an app config resolved
+     * before this field existed) behaves exactly like an empty array.
+     */
+    capabilityDeclaredConsentPurposes?: readonly string[];
+    /** The person's stored consent, or null when they have no preferences record. */
+    privacy: {
+        consentedPurposes?: readonly string[];
+        consentDecidedAt?: Date | string;
+    } | null | undefined;
+}
+export interface ConsentGateState {
+    status: ConsentGateStatus;
+    /** Purposes the application requires, in vocabulary order. */
+    requiredPurposes: ConsentPurpose[];
+    /** The required purposes the person has not granted. Non-empty exactly when `status` is REQUIRED. */
+    missingRequiredPurposes: ConsentPurpose[];
+    /**
+     * Purposes the application actually USES on consent and does not require — the only ones a prompt
+     * may offer. Never the whole vocabulary: asking for a purpose nothing processes collects a consent
+     * that means nothing.
+     */
+    optionalPurposes: ConsentPurpose[];
+    /** What the person has granted, normalized. */
+    grantedPurposes: ConsentPurpose[];
+    /** The operator's own words for what the requirement gates, when it gates anything. */
+    gatedProcessing: string | undefined;
+}
+/**
+ * Derive the gate's state from configuration and the stored decision. Pure, so every branch is
+ * pinned without rendering.
+ *
+ * ## Fail closed on an absent record
+ *
+ * A person with no preferences record has granted nothing. When the application requires a purpose,
+ * that is REQUIRED, never "not loaded yet, let them through" — the route already waits for session
+ * restore, so an absent record here is a real absence.
+ *
+ * ## Which purposes a prompt offers
+ *
+ * Total over the configuration that states a use, and deliberately not over the enum: ANALYTICS when
+ * analytics is enabled and consent-based; a `consentGate` purpose when at least one resource operation
+ * declared one (#1462) — no configuration states a consent-based MARKETING use today, so no
+ * application-tier surface asks for it; the inbound-contact form asks for it where it is used.
+ */
+export declare function deriveConsentGateState(input: ConsentGateInput): ConsentGateState;
+/**
+ * The purpose set to store when the person chooses `selected` on a surface that offered `offered`.
+ *
+ * Purposes the surface did not offer keep their stored grant — a prompt about analytics must never
+ * withdraw a purpose it did not show — and an offered purpose is granted exactly when selected.
+ */
+export declare function composeConsentDecision(granted: readonly ConsentPurpose[], offered: readonly ConsentPurpose[], selected: readonly ConsentPurpose[]): ConsentPurpose[];
+/**
+ * The required purposes a `decide(offered, selected)` call would leave UNMET, were it saved as-is
+ * (R9, #1258 Step 3).
+ *
+ * No shipped surface can trigger a non-empty result today — the REQUIRED panel always keeps every
+ * required purpose in `selected`, and the PROMPT panel's `offered` never includes one (`optionalPurposes`
+ * excludes `requiredPurposes` by construction in {@link deriveConsentGateState}). This exists so a
+ * withdrawal surface neither of those two is — an application's own settings page, a future preset —
+ * can compute the cost of a withdrawal BEFORE it saves.
+ *
+ * "Refusing the withdrawal is not available" (Step 3's own edge-case table): consent must be as easy to
+ * withdraw as to give. So this never blocks anything by itself — it only lets the caller warn, or
+ * require the person to acknowledge the cost, before calling `decide`.
+ */
+export declare function consentWithdrawalCost(state: Pick<ConsentGateState, 'requiredPurposes' | 'grantedPurposes'>, offered: readonly ConsentPurpose[], selected: readonly ConsentPurpose[]): ConsentPurpose[];
+//# sourceMappingURL=consent-gate.frontend.utils.d.ts.map

package/dist/esm/core/security/consent-gate.frontend.utils.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"consent-gate.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/consent-gate.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,EAGd,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,oBAAY,iBAAiB;IAC3B,0GAA0G;IAC1G,cAAc,kBAAkB;IAChC;;;;OAIG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,MAAM,WAAW;IACjB,mGAAmG;IACnG,SAAS,cAAc;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,yBAAyB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IACjE,2EAA2E;IAC3E,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4FAA4F;IAC5F,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,iFAAiF;IACjF,OAAO,EAAE;QAAE,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAC;CACzG;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,8DAA8D;IAC9D,gBAAgB,EAAE,cAAc,EAAE,CAAC;IACnC,qGAAqG;IACrG,uBAAuB,EAAE,cAAc,EAAE,CAAC;IAC1C;;;;OAIG;IACH,gBAAgB,EAAE,cAAc,EAAE,CAAC;IACnC,+CAA+C;IAC/C,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAyChF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC,cAAc,EAAE,CAIlB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,GAAG,iBAAiB,CAAC,EACrE,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC,cAAc,EAAE,CAGlB"}