@wildo-ai/saas-models 1.1.3 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (496) hide show
  1. package/dist/esm/__tests__/setup.d.ts.map +1 -1
  2. package/dist/esm/_inspect.d.ts.map +1 -1
  3. package/dist/esm/applications/application-metadata.shared.resources-config.schemas.d.ts.map +1 -1
  4. package/dist/esm/applications/application-subject.shared.schemas.d.ts.map +1 -1
  5. package/dist/esm/applications/application-versions.shared.resources-config.schemas.d.ts.map +1 -1
  6. package/dist/esm/applications/applications-context.schemas.d.ts.map +1 -1
  7. package/dist/esm/applications/applications.shared.resources-config.schemas.d.ts.map +1 -1
  8. package/dist/esm/applications/applications.shared.resources-config.schemas.js.map +1 -1
  9. package/dist/esm/applications/applications.shared.schemas.d.ts.map +1 -1
  10. package/dist/esm/billing/billing-account.shared.resources-config.schemas.d.ts.map +1 -1
  11. package/dist/esm/billing/billing-account.shared.schemas.d.ts.map +1 -1
  12. package/dist/esm/billing/billing-configuration.shared.schemas.d.ts.map +1 -1
  13. package/dist/esm/billing/billing-configuration.shared.schemas.js.map +1 -1
  14. package/dist/esm/billing/billing-enums.shared.schemas.d.ts.map +1 -1
  15. package/dist/esm/billing/billing-enums.shared.schemas.js.map +1 -1
  16. package/dist/esm/billing/billing-types.shared.schemas.d.ts +1 -0
  17. package/dist/esm/billing/billing-types.shared.schemas.d.ts.map +1 -1
  18. package/dist/esm/billing/billing-types.shared.schemas.js +45 -0
  19. package/dist/esm/billing/billing-types.shared.schemas.js.map +1 -1
  20. package/dist/esm/billing/credit-pool.shared.resources-config.schemas.d.ts.map +1 -1
  21. package/dist/esm/billing/credit-pool.shared.schemas.d.ts.map +1 -1
  22. package/dist/esm/billing/invoice-ref.shared.resources-config.schemas.d.ts.map +1 -1
  23. package/dist/esm/billing/invoice-ref.shared.schemas.d.ts.map +1 -1
  24. package/dist/esm/billing/price.shared.resources-config.schemas.d.ts.map +1 -1
  25. package/dist/esm/billing/price.shared.schemas.d.ts.map +1 -1
  26. package/dist/esm/billing/price.shared.schemas.js.map +1 -1
  27. package/dist/esm/billing/product-behavior-policy.shared.schemas.d.ts.map +1 -1
  28. package/dist/esm/billing/product-behavior-policy.shared.schemas.js.map +1 -1
  29. package/dist/esm/billing/product-definition.shared.schemas.d.ts.map +1 -1
  30. package/dist/esm/billing/product.shared.resources-config.schemas.d.ts.map +1 -1
  31. package/dist/esm/billing/product.shared.schemas.d.ts.map +1 -1
  32. package/dist/esm/billing/product.shared.schemas.js.map +1 -1
  33. package/dist/esm/billing/promotions.shared.resources-config.schemas.d.ts.map +1 -1
  34. package/dist/esm/billing/promotions.shared.schemas.d.ts.map +1 -1
  35. package/dist/esm/billing/referral.shared.resources-config.schemas.d.ts.map +1 -1
  36. package/dist/esm/billing/referral.shared.schemas.d.ts.map +1 -1
  37. package/dist/esm/billing/subscription.shared.resources-config.schemas.d.ts.map +1 -1
  38. package/dist/esm/billing/subscription.shared.resources-config.schemas.js.map +1 -1
  39. package/dist/esm/billing/subscription.shared.schemas.d.ts.map +1 -1
  40. package/dist/esm/billing/usage-record.shared.resources-config.schemas.d.ts.map +1 -1
  41. package/dist/esm/billing/usage-record.shared.schemas.d.ts.map +1 -1
  42. package/dist/esm/billing/usage-record.shared.schemas.js.map +1 -1
  43. package/dist/esm/charts/aggregation-query.shared.schemas.d.ts.map +1 -1
  44. package/dist/esm/charts/chart-definition-builder.shared.d.ts.map +1 -1
  45. package/dist/esm/companion/provider-discovery.shared.schemas.d.ts +2 -0
  46. package/dist/esm/companion/provider-discovery.shared.schemas.d.ts.map +1 -1
  47. package/dist/esm/companion/provider-discovery.shared.schemas.js.map +1 -1
  48. package/dist/esm/companion/shared-library-companion.shared.definitions.d.ts.map +1 -1
  49. package/dist/esm/companion-exports.d.ts.map +1 -1
  50. package/dist/esm/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.d.ts.map +1 -1
  51. package/dist/esm/compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.js.map +1 -1
  52. package/dist/esm/compliance/audit-trails/audit-log-sink.shared.schemas.d.ts.map +1 -1
  53. package/dist/esm/compliance/audit-trails/audit-logs.shared.resources-config.schemas.d.ts.map +1 -1
  54. package/dist/esm/compliance/audit-trails/audit-trail-config.shared.schemas.d.ts.map +1 -1
  55. package/dist/esm/compliance/audit-trails/audit-trail-config.shared.schemas.js.map +1 -1
  56. package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.d.ts +178 -6
  57. package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.d.ts.map +1 -1
  58. package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.js +326 -4
  59. package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.js.map +1 -1
  60. package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.d.ts.map +1 -1
  61. package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.js +22 -0
  62. package/dist/esm/compliance/audit-trails/security-audit-event-envelope.shared.schema.js.map +1 -1
  63. package/dist/esm/compliance/documents/governed-documents.shared.schemas.d.ts.map +1 -1
  64. package/dist/esm/compliance/privacy/ai-use-posture.shared.schemas.d.ts.map +1 -1
  65. package/dist/esm/compliance/privacy/client-storage.shared.schemas.d.ts.map +1 -1
  66. package/dist/esm/compliance/privacy/data-retention.shared.schemas.d.ts.map +1 -1
  67. package/dist/esm/compliance/privacy/impersonalization-scrub.shared.utils.d.ts.map +1 -1
  68. package/dist/esm/compliance/privacy/impersonalization.shared.schemas.d.ts.map +1 -1
  69. package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.d.ts +27 -0
  70. package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.d.ts.map +1 -1
  71. package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js +36 -2
  72. package/dist/esm/compliance/privacy/operating-jurisdictions.shared.schemas.js.map +1 -1
  73. package/dist/esm/compliance/privacy/operator-compliance-identity.shared.schemas.d.ts.map +1 -1
  74. package/dist/esm/compliance/privacy/personal-data-category.shared.schemas.d.ts.map +1 -1
  75. package/dist/esm/compliance/privacy/personal-data-declaration.shared.utils.d.ts.map +1 -1
  76. package/dist/esm/compliance/privacy/privacy.shared.schemas.d.ts.map +1 -1
  77. package/dist/esm/compliance/privacy/privacy.shared.schemas.js.map +1 -1
  78. package/dist/esm/compliance/privacy/redaction.shared.schemas.d.ts.map +1 -1
  79. package/dist/esm/compliance/privacy/redaction.shared.schemas.js.map +1 -1
  80. package/dist/esm/compliance/privacy/retention-schedule.shared.schemas.d.ts.map +1 -1
  81. package/dist/esm/compliance/privacy/subject-erasure.shared.schemas.d.ts.map +1 -1
  82. package/dist/esm/compliance/privacy/subject-export-render.shared.utils.d.ts.map +1 -1
  83. package/dist/esm/compliance/privacy/subject-export.shared.schemas.d.ts.map +1 -1
  84. package/dist/esm/compliance/privacy/subject-export.shared.schemas.js.map +1 -1
  85. package/dist/esm/config/analytics-value-moments.shared.schemas.d.ts.map +1 -1
  86. package/dist/esm/config/analytics-value-moments.shared.schemas.js.map +1 -1
  87. package/dist/esm/config/app-configuration-shared.shared.schemas.d.ts.map +1 -1
  88. package/dist/esm/config/auth-config-resolution.shared.utils.d.ts.map +1 -1
  89. package/dist/esm/config/auth-config-resolution.shared.utils.js.map +1 -1
  90. package/dist/esm/config/brand-assets.shared.schemas.d.ts.map +1 -1
  91. package/dist/esm/config/entity-identity-config.shared.schemas.d.ts.map +1 -1
  92. package/dist/esm/config/entity-identity-config.shared.schemas.js.map +1 -1
  93. package/dist/esm/config/frontend/chart-definition.shared.schemas.d.ts +14 -14
  94. package/dist/esm/config/frontend/chart-definition.shared.schemas.d.ts.map +1 -1
  95. package/dist/esm/config/frontend/chart-registration-alignment.shared.d.ts +139 -3
  96. package/dist/esm/config/frontend/chart-registration-alignment.shared.d.ts.map +1 -1
  97. package/dist/esm/config/frontend/chart-registration-alignment.shared.js +151 -4
  98. package/dist/esm/config/frontend/chart-registration-alignment.shared.js.map +1 -1
  99. package/dist/esm/config/frontend/navigation.shared.schemas.d.ts.map +1 -1
  100. package/dist/esm/config/frontend/onboarding.shared.schemas.d.ts.map +1 -1
  101. package/dist/esm/config/registration-acquisition-policy.shared.utils.d.ts.map +1 -1
  102. package/dist/esm/config-authoring.entry.d.ts.map +1 -1
  103. package/dist/esm/crdt/crdt-merge.shared.utils.d.ts.map +1 -1
  104. package/dist/esm/data-seeding/data-seeding-config.shared.schemas.d.ts.map +1 -1
  105. package/dist/esm/errors/errors.custom-message-ref.shared.definitions.d.ts +6 -0
  106. package/dist/esm/errors/errors.custom-message-ref.shared.definitions.d.ts.map +1 -1
  107. package/dist/esm/errors/errors.custom-message-ref.shared.definitions.js +6 -0
  108. package/dist/esm/errors/errors.custom-message-ref.shared.definitions.js.map +1 -1
  109. package/dist/esm/errors/errors.shared.definitions.d.ts.map +1 -1
  110. package/dist/esm/errors/errors.shared.schemas.d.ts.map +1 -1
  111. package/dist/esm/errors/errors.shared.utils.d.ts.map +1 -1
  112. package/dist/esm/external-data/external-data-pipeline.shared.schemas.d.ts.map +1 -1
  113. package/dist/esm/external-data/external-data-pipeline.shared.schemas.js.map +1 -1
  114. package/dist/esm/external-data.exports.d.ts.map +1 -1
  115. package/dist/esm/external-providers/compose-provider-registry.shared.d.ts.map +1 -1
  116. package/dist/esm/external-providers/engine-capabilities.shared.schemas.d.ts +7 -0
  117. package/dist/esm/external-providers/engine-capabilities.shared.schemas.d.ts.map +1 -1
  118. package/dist/esm/external-providers/engine-capabilities.shared.schemas.js +7 -0
  119. package/dist/esm/external-providers/engine-capabilities.shared.schemas.js.map +1 -1
  120. package/dist/esm/external-providers/engine-capability-resolution-mode.shared.d.ts.map +1 -1
  121. package/dist/esm/external-providers/engine-capability-resolution-mode.shared.js.map +1 -1
  122. package/dist/esm/external-providers/external-providers.shared.schemas.d.ts.map +1 -1
  123. package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.d.ts +4 -0
  124. package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.d.ts.map +1 -1
  125. package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.d.ts.map +1 -1
  126. package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.js.map +1 -1
  127. package/dist/esm/external-providers/frontend-capability-runtime.shared.types.d.ts.map +1 -1
  128. package/dist/esm/external-providers/frontend-capability-runtime.shared.types.js.map +1 -1
  129. package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.d.ts +57 -0
  130. package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.d.ts.map +1 -1
  131. package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.js +29 -0
  132. package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.js.map +1 -1
  133. package/dist/esm/external-providers/frontend-provider-public-config.shared.d.ts +175 -0
  134. package/dist/esm/external-providers/frontend-provider-public-config.shared.d.ts.map +1 -0
  135. package/dist/esm/external-providers/frontend-provider-public-config.shared.js +207 -0
  136. package/dist/esm/external-providers/frontend-provider-public-config.shared.js.map +1 -0
  137. package/dist/esm/external-providers/provider-capability.shared.schemas.d.ts.map +1 -1
  138. package/dist/esm/external-providers/provider-capability.shared.schemas.js.map +1 -1
  139. package/dist/esm/external-providers/provider-compliance-profile.shared.schemas.d.ts +18 -8
  140. package/dist/esm/external-providers/provider-compliance-profile.shared.schemas.d.ts.map +1 -1
  141. package/dist/esm/external-providers/provider-compliance-profile.shared.schemas.js +10 -4
  142. package/dist/esm/external-providers/provider-compliance-profile.shared.schemas.js.map +1 -1
  143. package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.d.ts +165 -0
  144. package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.d.ts.map +1 -0
  145. package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.js +39 -0
  146. package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.js.map +1 -0
  147. package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.d.ts.map +1 -1
  148. package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.js.map +1 -1
  149. package/dist/esm/external-providers/provider-metadata.shared.schemas.d.ts.map +1 -1
  150. package/dist/esm/external-providers/provider-metadata.shared.schemas.js.map +1 -1
  151. package/dist/esm/external-providers/provider-protocol.shared.schemas.d.ts.map +1 -1
  152. package/dist/esm/external-providers/provider-protocol.shared.schemas.js.map +1 -1
  153. package/dist/esm/external-providers/provider-tier-rule.shared.utils.d.ts.map +1 -1
  154. package/dist/esm/external-providers/provider-tier-rule.shared.utils.js.map +1 -1
  155. package/dist/esm/external-providers/provider-usage-pricing.shared.schemas.d.ts.map +1 -1
  156. package/dist/esm/features/application-features.shared.resources-config.schemas.d.ts.map +1 -1
  157. package/dist/esm/features/application-features.shared.resources-config.schemas.js +12 -0
  158. package/dist/esm/features/application-features.shared.resources-config.schemas.js.map +1 -1
  159. package/dist/esm/features/core-feature-definitions.shared.d.ts.map +1 -1
  160. package/dist/esm/features/core-feature-definitions.shared.js.map +1 -1
  161. package/dist/esm/features/feature-builders.shared.d.ts.map +1 -1
  162. package/dist/esm/features/feature-builders.shared.js.map +1 -1
  163. package/dist/esm/features/feature-definition.shared.schemas.d.ts.map +1 -1
  164. package/dist/esm/features/feature-registry.shared.d.ts.map +1 -1
  165. package/dist/esm/features/feature-resolution.shared.schemas.d.ts.map +1 -1
  166. package/dist/esm/features/scope-features.shared.schemas.d.ts.map +1 -1
  167. package/dist/esm/features/user-features.shared.resources-config.schemas.d.ts.map +1 -1
  168. package/dist/esm/features/user-features.shared.resources-config.schemas.js +12 -0
  169. package/dist/esm/features/user-features.shared.resources-config.schemas.js.map +1 -1
  170. package/dist/esm/files/file-remote-reference-link.shared.schemas.d.ts +73 -0
  171. package/dist/esm/files/file-remote-reference-link.shared.schemas.d.ts.map +1 -0
  172. package/dist/esm/files/file-remote-reference-link.shared.schemas.js +62 -0
  173. package/dist/esm/files/file-remote-reference-link.shared.schemas.js.map +1 -0
  174. package/dist/esm/files/file-upload-grant.shared.schemas.d.ts.map +1 -1
  175. package/dist/esm/files/file-upload-grant.shared.schemas.js.map +1 -1
  176. package/dist/esm/files/files.shared.resources-config.schemas.d.ts.map +1 -1
  177. package/dist/esm/files/files.shared.schemas.d.ts.map +1 -1
  178. package/dist/esm/files/files.shared.schemas.js.map +1 -1
  179. package/dist/esm/files/files.shared.utils.d.ts.map +1 -1
  180. package/dist/esm/flows-actors/a2a-push-delivery-log.shared.resources-config.schemas.d.ts.map +1 -1
  181. package/dist/esm/flows-actors/a2a-push-delivery-log.shared.schemas.d.ts.map +1 -1
  182. package/dist/esm/flows-actors/a2a-token-budget-state.shared.resources-config.schemas.d.ts.map +1 -1
  183. package/dist/esm/flows-actors/a2a-token-budget-state.shared.schemas.d.ts.map +1 -1
  184. package/dist/esm/flows-actors/actors.shared.schemas.d.ts.map +1 -1
  185. package/dist/esm/flows-actors/actors.shared.schemas.js.map +1 -1
  186. package/dist/esm/flows-actors/agent-traceability.shared.schemas.d.ts.map +1 -1
  187. package/dist/esm/flows-actors/agents.shared.schemas.d.ts.map +1 -1
  188. package/dist/esm/flows-actors/agents.shared.schemas.js.map +1 -1
  189. package/dist/esm/flows-actors/apps-blueprint/apps-blueprint.shared.schemas.d.ts +6 -6
  190. package/dist/esm/flows-actors/apps-blueprint/apps-blueprint.shared.schemas.d.ts.map +1 -1
  191. package/dist/esm/flows-actors/apps-blueprint/artifacts.apps-blueprint.shared.schemas.d.ts.map +1 -1
  192. package/dist/esm/flows-actors/deliberation.shared.schemas.d.ts.map +1 -1
  193. package/dist/esm/flows-actors/deliberation.shared.schemas.js.map +1 -1
  194. package/dist/esm/flows-actors/flows-actors-execution.shared.resources-config.schemas.d.ts.map +1 -1
  195. package/dist/esm/flows-actors/flows-actors-execution.shared.schemas.d.ts.map +1 -1
  196. package/dist/esm/flows-actors/flows-actors-execution.shared.schemas.js.map +1 -1
  197. package/dist/esm/flows-actors/flows-actors-task.shared.resources-config.schemas.d.ts.map +1 -1
  198. package/dist/esm/flows-actors/flows-actors-task.shared.schemas.d.ts.map +1 -1
  199. package/dist/esm/flows-actors/flows-actors.commons.shared.schemas.d.ts.map +1 -1
  200. package/dist/esm/flows-actors/flows-actors.commons.shared.schemas.js.map +1 -1
  201. package/dist/esm/flows-actors/flows-actors.configuration.shared.schemas.d.ts.map +1 -1
  202. package/dist/esm/flows-actors/flows-actors.frontend.shared.schemas.d.ts.map +1 -1
  203. package/dist/esm/flows-actors/flows-actors.io.shared.schemas.d.ts.map +1 -1
  204. package/dist/esm/flows-actors/flows-actors.io.shared.schemas.js.map +1 -1
  205. package/dist/esm/flows-actors/flows-actors.system.shared.definitions.d.ts.map +1 -1
  206. package/dist/esm/flows-actors/flows-actors.system.shared.schemas.d.ts.map +1 -1
  207. package/dist/esm/flows-actors/flows-actors.system.shared.schemas.js.map +1 -1
  208. package/dist/esm/flows-actors/flows.shared.schemas.d.ts.map +1 -1
  209. package/dist/esm/flows-actors/flows.shared.schemas.js.map +1 -1
  210. package/dist/esm/flows-actors/mcp-servers.shared.schemas.d.ts +2 -0
  211. package/dist/esm/flows-actors/mcp-servers.shared.schemas.d.ts.map +1 -1
  212. package/dist/esm/flows-actors/mcp-servers.shared.schemas.js +11 -0
  213. package/dist/esm/flows-actors/mcp-servers.shared.schemas.js.map +1 -1
  214. package/dist/esm/flows-actors/meta-workflows/actions.meta-workflows.shared.schemas.d.ts.map +1 -1
  215. package/dist/esm/flows-actors/meta-workflows/budget-authority.meta-workflows.shared.schemas.d.ts.map +1 -1
  216. package/dist/esm/flows-actors/meta-workflows/budget-authority.meta-workflows.shared.schemas.js.map +1 -1
  217. package/dist/esm/flows-actors/meta-workflows/catalog.meta-workflows.shared.schemas.d.ts.map +1 -1
  218. package/dist/esm/flows-actors/meta-workflows/context-selection.meta-workflows.shared.schemas.d.ts.map +1 -1
  219. package/dist/esm/flows-actors/meta-workflows/context-selection.meta-workflows.shared.schemas.js.map +1 -1
  220. package/dist/esm/flows-actors/meta-workflows/continuity-identifiers.meta-workflows.shared.schemas.d.ts.map +1 -1
  221. package/dist/esm/flows-actors/meta-workflows/decisions.meta-workflows.shared.schemas.d.ts.map +1 -1
  222. package/dist/esm/flows-actors/meta-workflows/decisions.meta-workflows.shared.schemas.js.map +1 -1
  223. package/dist/esm/flows-actors/meta-workflows/execution-binding-common.meta-workflows.shared.schemas.d.ts.map +1 -1
  224. package/dist/esm/flows-actors/meta-workflows/execution-binding-common.meta-workflows.shared.schemas.js.map +1 -1
  225. package/dist/esm/flows-actors/meta-workflows/portable-primitives.meta-workflows.shared.schemas.d.ts.map +1 -1
  226. package/dist/esm/flows-actors/prompt-ir.shared.schemas.d.ts.map +1 -1
  227. package/dist/esm/flows-actors/task-continuity-binding.actors.shared.schemas.d.ts.map +1 -1
  228. package/dist/esm/flows-actors/tasks.actors.shared.schemas.d.ts.map +1 -1
  229. package/dist/esm/frontend-definitions/settings-destination-ref.definitions.d.ts +112 -0
  230. package/dist/esm/frontend-definitions/settings-destination-ref.definitions.d.ts.map +1 -0
  231. package/dist/esm/frontend-definitions/settings-destination-ref.definitions.js +113 -0
  232. package/dist/esm/frontend-definitions/settings-destination-ref.definitions.js.map +1 -0
  233. package/dist/esm/guidance/guidance-flow.shared.schemas.d.ts.map +1 -1
  234. package/dist/esm/guidance/guidance-state.shared.resources-config.schemas.d.ts.map +1 -1
  235. package/dist/esm/guidance/guidance-state.shared.schemas.d.ts.map +1 -1
  236. package/dist/esm/guidance/guidance-state.shared.utils.d.ts.map +1 -1
  237. package/dist/esm/guidance/guidance-state.shared.utils.js.map +1 -1
  238. package/dist/esm/guidance/lifecycle-config.shared.schemas.d.ts.map +1 -1
  239. package/dist/esm/guidance/lifecycle-state.shared.resources-config.schemas.d.ts.map +1 -1
  240. package/dist/esm/guidance/lifecycle-state.shared.schemas.d.ts.map +1 -1
  241. package/dist/esm/guidance/milestone-builders.shared.d.ts.map +1 -1
  242. package/dist/esm/guidance/milestone-definition.shared.schemas.d.ts.map +1 -1
  243. package/dist/esm/guidance/progression-state.shared.resources-config.schemas.d.ts.map +1 -1
  244. package/dist/esm/guidance/progression-state.shared.schemas.d.ts.map +1 -1
  245. package/dist/esm/guidance/progression-state.shared.schemas.js.map +1 -1
  246. package/dist/esm/http-api-binding/http-api-binding-id.shared.utils.d.ts.map +1 -1
  247. package/dist/esm/http-api-binding/http-api-binding.shared.schemas.d.ts.map +1 -1
  248. package/dist/esm/http-api-binding/http-api-binding.shared.schemas.js.map +1 -1
  249. package/dist/esm/i18n/labelling.dto.shared.schemas.d.ts.map +1 -1
  250. package/dist/esm/index.d.ts +6 -0
  251. package/dist/esm/index.d.ts.map +1 -1
  252. package/dist/esm/index.js +6 -0
  253. package/dist/esm/index.js.map +1 -1
  254. package/dist/esm/meta-workflows.exports.d.ts.map +1 -1
  255. package/dist/esm/monitoring/monitoring.shared.schemas.d.ts.map +1 -1
  256. package/dist/esm/notifications/email/email-context.shared.schemas.d.ts.map +1 -1
  257. package/dist/esm/notifications/email/email-template-registry.shared.schemas.d.ts.map +1 -1
  258. package/dist/esm/notifications/email/email-template-registry.shared.schemas.js.map +1 -1
  259. package/dist/esm/notifications/email/email-template.shared.enums.d.ts.map +1 -1
  260. package/dist/esm/notifications/email/email-template.shared.enums.js.map +1 -1
  261. package/dist/esm/notifications/m2m/m2m-webhook-delivery-contract.shared.d.ts.map +1 -1
  262. package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.resources-config.schemas.d.ts.map +1 -1
  263. package/dist/esm/notifications/m2m/m2m-webhook-delivery-log.shared.schemas.d.ts.map +1 -1
  264. package/dist/esm/notifications/m2m/webhook-config.shared.resources-config.schemas.d.ts.map +1 -1
  265. package/dist/esm/notifications/m2m/webhook-config.shared.resources-config.schemas.js.map +1 -1
  266. package/dist/esm/notifications/m2m/webhook-config.shared.schemas.d.ts.map +1 -1
  267. package/dist/esm/notifications/m2m/webhook-config.shared.schemas.js.map +1 -1
  268. package/dist/esm/notifications/notification-badges.core.definitions.d.ts.map +1 -1
  269. package/dist/esm/notifications/notification-badges.core.definitions.js.map +1 -1
  270. package/dist/esm/notifications/notification-badges.schemas.d.ts.map +1 -1
  271. package/dist/esm/notifications/notification-badges.schemas.js.map +1 -1
  272. package/dist/esm/notifications/notification-badges.shared.resources-config.schemas.d.ts.map +1 -1
  273. package/dist/esm/notifications/notifications.shared.schemas.d.ts +51 -0
  274. package/dist/esm/notifications/notifications.shared.schemas.d.ts.map +1 -1
  275. package/dist/esm/notifications/notifications.shared.schemas.js +51 -0
  276. package/dist/esm/notifications/notifications.shared.schemas.js.map +1 -1
  277. package/dist/esm/organizations/organization-features.shared.resources-config.schemas.d.ts.map +1 -1
  278. package/dist/esm/organizations/organization-features.shared.resources-config.schemas.js +13 -0
  279. package/dist/esm/organizations/organization-features.shared.resources-config.schemas.js.map +1 -1
  280. package/dist/esm/organizations/organization-members.shared.resources-config.schemas.d.ts.map +1 -1
  281. package/dist/esm/organizations/organization-members.shared.schemas.d.ts.map +1 -1
  282. package/dist/esm/organizations/organization-notifications.shared.resources-config.schemas.d.ts.map +1 -1
  283. package/dist/esm/organizations/organization-notifications.shared.schemas.d.ts.map +1 -1
  284. package/dist/esm/organizations/organization-notifications.shared.schemas.js.map +1 -1
  285. package/dist/esm/organizations/organization-preferences.shared.resources-config.schemas.d.ts.map +1 -1
  286. package/dist/esm/organizations/organization-preferences.shared.schemas.d.ts.map +1 -1
  287. package/dist/esm/organizations/organization-preferences.shared.schemas.js.map +1 -1
  288. package/dist/esm/organizations/organization-profile.shared.resources-config.schemas.d.ts.map +1 -1
  289. package/dist/esm/organizations/organization-profile.shared.schemas.d.ts.map +1 -1
  290. package/dist/esm/organizations/organization-profile.shared.schemas.js.map +1 -1
  291. package/dist/esm/organizations/organization-unit-inheritance.shared.d.ts.map +1 -1
  292. package/dist/esm/organizations/organization-unit-members.shared.resources-config.schemas.d.ts.map +1 -1
  293. package/dist/esm/organizations/organization-unit-members.shared.schemas.d.ts.map +1 -1
  294. package/dist/esm/organizations/organization-unit-narrowing-decision.shared.d.ts.map +1 -1
  295. package/dist/esm/organizations/organization-unit-narrowing.example.d.ts.map +1 -1
  296. package/dist/esm/organizations/organization-unit-narrowing.shared.d.ts.map +1 -1
  297. package/dist/esm/organizations/organization-unit-narrowing.shared.js.map +1 -1
  298. package/dist/esm/organizations/organization-units.shared.resources-config.schemas.d.ts.map +1 -1
  299. package/dist/esm/organizations/organization-units.shared.schemas.d.ts.map +1 -1
  300. package/dist/esm/organizations/organizations.shared.resources-config.schemas.d.ts.map +1 -1
  301. package/dist/esm/organizations/organizations.shared.resources-config.schemas.js.map +1 -1
  302. package/dist/esm/organizations/organizations.shared.schemas.d.ts.map +1 -1
  303. package/dist/esm/organizations/tenant-teardown-config.shared.schemas.d.ts +13 -0
  304. package/dist/esm/organizations/tenant-teardown-config.shared.schemas.d.ts.map +1 -1
  305. package/dist/esm/organizations/tenant-teardown-config.shared.schemas.js +13 -0
  306. package/dist/esm/organizations/tenant-teardown-config.shared.schemas.js.map +1 -1
  307. package/dist/esm/provider-registration-runtime.exports.d.ts.map +1 -1
  308. package/dist/esm/public-runtime/index.d.ts +22 -0
  309. package/dist/esm/public-runtime/index.d.ts.map +1 -1
  310. package/dist/esm/public-runtime/index.js +14 -0
  311. package/dist/esm/public-runtime/index.js.map +1 -1
  312. package/dist/esm/queue/jobs.shared.resources-config.schemas.d.ts.map +1 -1
  313. package/dist/esm/queue/jobs.shared.resources-config.schemas.js.map +1 -1
  314. package/dist/esm/queue/jobs.shared.schemas.d.ts.map +1 -1
  315. package/dist/esm/queue/jobs.shared.schemas.js.map +1 -1
  316. package/dist/esm/queue/jobs.shared.utils.d.ts.map +1 -1
  317. package/dist/esm/queue/queues.shared.schemas.d.ts.map +1 -1
  318. package/dist/esm/queue/queues.shared.utils.d.ts.map +1 -1
  319. package/dist/esm/requests/manual-controllers-routes-documentation.d.ts.map +1 -1
  320. package/dist/esm/requests/manual-controllers-routes-documentation.js +57 -3
  321. package/dist/esm/requests/manual-controllers-routes-documentation.js.map +1 -1
  322. package/dist/esm/requests/manual-controllers-routes-urls.d.ts +47 -0
  323. package/dist/esm/requests/manual-controllers-routes-urls.d.ts.map +1 -1
  324. package/dist/esm/requests/manual-controllers-routes-urls.js +51 -0
  325. package/dist/esm/requests/manual-controllers-routes-urls.js.map +1 -1
  326. package/dist/esm/requests/rate-limits.shared.schemas.d.ts.map +1 -1
  327. package/dist/esm/requests/rate-limits.shared.schemas.js.map +1 -1
  328. package/dist/esm/requests/websocket.shared.schemas.d.ts +9 -7
  329. package/dist/esm/requests/websocket.shared.schemas.d.ts.map +1 -1
  330. package/dist/esm/requests/websocket.shared.schemas.js +17 -0
  331. package/dist/esm/requests/websocket.shared.schemas.js.map +1 -1
  332. package/dist/esm/resources/child-operations.shared.schemas.d.ts.map +1 -1
  333. package/dist/esm/resources/context-policy.shared.schemas.d.ts.map +1 -1
  334. package/dist/esm/resources/relationship-display.shared.schemas.d.ts.map +1 -1
  335. package/dist/esm/resources/resources-config.shared.factory.d.ts.map +1 -1
  336. package/dist/esm/resources/resources-config.shared.factory.js +98 -5
  337. package/dist/esm/resources/resources-config.shared.factory.js.map +1 -1
  338. package/dist/esm/resources/resources-config.shared.schemas.d.ts +48 -1
  339. package/dist/esm/resources/resources-config.shared.schemas.d.ts.map +1 -1
  340. package/dist/esm/resources/resources-config.shared.schemas.js.map +1 -1
  341. package/dist/esm/resources/resources-registry.shared.core.definitions.d.ts.map +1 -1
  342. package/dist/esm/resources/resources-registry.shared.core.definitions.js +54 -0
  343. package/dist/esm/resources/resources-registry.shared.core.definitions.js.map +1 -1
  344. package/dist/esm/resources/resources-relationships.shared.factory.d.ts.map +1 -1
  345. package/dist/esm/resources/resources-relationships.shared.factory.js.map +1 -1
  346. package/dist/esm/resources/resources-serialization.shared.schemas.d.ts.map +1 -1
  347. package/dist/esm/resources/resources.shared.core.definitions.d.ts +17 -0
  348. package/dist/esm/resources/resources.shared.core.definitions.d.ts.map +1 -1
  349. package/dist/esm/resources/resources.shared.core.definitions.js +18 -0
  350. package/dist/esm/resources/resources.shared.core.definitions.js.map +1 -1
  351. package/dist/esm/resources/resources.shared.schemas.d.ts.map +1 -1
  352. package/dist/esm/resources/resources.shared.schemas.js.map +1 -1
  353. package/dist/esm/resources/resources.shared.utils.d.ts +32 -7
  354. package/dist/esm/resources/resources.shared.utils.d.ts.map +1 -1
  355. package/dist/esm/resources/resources.shared.utils.js +32 -7
  356. package/dist/esm/resources/resources.shared.utils.js.map +1 -1
  357. package/dist/esm/resources/utils/collection-export.shared.utils.d.ts.map +1 -1
  358. package/dist/esm/resources/utils/composition-cascade-deletability.validation.d.ts.map +1 -1
  359. package/dist/esm/resources/utils/composition-seedability.validation.d.ts.map +1 -1
  360. package/dist/esm/resources/utils/context-addressed-composition-singleton.shared.utils.d.ts.map +1 -1
  361. package/dist/esm/resources/utils/duplicate-relationship-registration.validation.d.ts.map +1 -1
  362. package/dist/esm/resources/utils/field-value-disclosure.utils.d.ts.map +1 -1
  363. package/dist/esm/resources/utils/field-value-disclosure.utils.js.map +1 -1
  364. package/dist/esm/resources/utils/persistence-adapter-discrimination.shared.utils.d.ts.map +1 -1
  365. package/dist/esm/resources/utils/repository-dto-builder.utils.d.ts.map +1 -1
  366. package/dist/esm/resources/utils/required-fk-fillability.validation.d.ts.map +1 -1
  367. package/dist/esm/resources/utils/resource-operation-type-guards.utils.d.ts.map +1 -1
  368. package/dist/esm/resources/utils/resource-polymorphism.factory.d.ts.map +1 -1
  369. package/dist/esm/resources/utils/resource-polymorphism.relationships.d.ts.map +1 -1
  370. package/dist/esm/resources/utils/resource-polymorphism.schemas.d.ts.map +1 -1
  371. package/dist/esm/resources/utils/resource-polymorphism.utils.d.ts.map +1 -1
  372. package/dist/esm/resources/utils/resource-subtree.utils.d.ts.map +1 -1
  373. package/dist/esm/resources/utils/resources-config-context-needs.utils.d.ts.map +1 -1
  374. package/dist/esm/resources/utils/resources-config-operations.dtos-builder.utils.d.ts.map +1 -1
  375. package/dist/esm/resources/utils/resources-config-operations.path.utils.d.ts.map +1 -1
  376. package/dist/esm/resources/utils/resources-config-operations.urls-builder.utils.d.ts.map +1 -1
  377. package/dist/esm/resources/utils/resources-config-operations.utils.d.ts.map +1 -1
  378. package/dist/esm/resources/utils/resources-serialization.utils.d.ts.map +1 -1
  379. package/dist/esm/resources/utils/resources-summary.utils.d.ts.map +1 -1
  380. package/dist/esm/resources/utils/resources-summary.utils.js.map +1 -1
  381. package/dist/esm/resources/utils/schema-family-builder.utils.d.ts.map +1 -1
  382. package/dist/esm/resources/utils/schema-type-inference.utils.d.ts.map +1 -1
  383. package/dist/esm/resources/utils/schema-type-utils.d.ts.map +1 -1
  384. package/dist/esm/resources/utils/schema-variant-resolver.utils.d.ts.map +1 -1
  385. package/dist/esm/resources/utils/shared-persistence-collection.utils.d.ts.map +1 -1
  386. package/dist/esm/resources/utils/shared-persistence-collection.utils.js.map +1 -1
  387. package/dist/esm/resources/utils/templatable-file-fields.shared.utils.d.ts.map +1 -1
  388. package/dist/esm/runtime/domain-module.shared.definitions.d.ts.map +1 -1
  389. package/dist/esm/runtime/domain-module.shared.definitions.js.map +1 -1
  390. package/dist/esm/runtime/execution-context.shared.schemas.d.ts.map +1 -1
  391. package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.d.ts.map +1 -1
  392. package/dist/esm/security/api-keys/api-keys-application.shared.resources-config.schemas.js.map +1 -1
  393. package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.d.ts.map +1 -1
  394. package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.js.map +1 -1
  395. package/dist/esm/security/api-keys/api-keys.shared.schemas.d.ts.map +1 -1
  396. package/dist/esm/security/authentications/anonymous-session/anonymous-session.shared.contract.d.ts.map +1 -1
  397. package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts +1 -1
  398. package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts.map +1 -1
  399. package/dist/esm/security/authentications/authentication.shared.dto.schemas.js.map +1 -1
  400. package/dist/esm/security/authentications/authentication.shared.schemas.d.ts.map +1 -1
  401. package/dist/esm/security/authentications/authentication.shared.schemas.js.map +1 -1
  402. package/dist/esm/security/authentications/authentication.shared.utils.d.ts.map +1 -1
  403. package/dist/esm/security/authentications/consumable-token.shared.schemas.d.ts.map +1 -1
  404. package/dist/esm/security/authentications/consumable-token.shared.schemas.js.map +1 -1
  405. package/dist/esm/security/authentications/cross-frontend-handoff.shared.dto.schemas.d.ts.map +1 -1
  406. package/dist/esm/security/authentications/password-reset.shared.dto.schemas.d.ts.map +1 -1
  407. package/dist/esm/security/authentications/registration.shared.dto.schemas.d.ts.map +1 -1
  408. package/dist/esm/security/authentications/registration.shared.dto.schemas.js.map +1 -1
  409. package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.d.ts.map +1 -1
  410. package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.d.ts.map +1 -1
  411. package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.d.ts.map +1 -1
  412. package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.js.map +1 -1
  413. package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.d.ts.map +1 -1
  414. package/dist/esm/security/authentications/scim/scim-tokens.shared.schemas.d.ts.map +1 -1
  415. package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.d.ts.map +1 -1
  416. package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.schemas.d.ts.map +1 -1
  417. package/dist/esm/security/authentications/siem/siem-delivery-reliability-contract.shared.d.ts.map +1 -1
  418. package/dist/esm/security/authentications/siem/siem-delivery-reliability-contract.shared.js.map +1 -1
  419. package/dist/esm/security/authentications/siem/siem-export-config.shared.resources-config.schemas.d.ts.map +1 -1
  420. package/dist/esm/security/authentications/siem/siem-export-config.shared.schemas.d.ts.map +1 -1
  421. package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.d.ts +3 -3
  422. package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.d.ts.map +1 -1
  423. package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.js +35 -5
  424. package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.js.map +1 -1
  425. package/dist/esm/security/authentications/sso/sso-config.shared.schemas.d.ts.map +1 -1
  426. package/dist/esm/security/authentications/sso/sso-config.shared.schemas.js.map +1 -1
  427. package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts.map +1 -1
  428. package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts +2 -0
  429. package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts.map +1 -1
  430. package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js +15 -0
  431. package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js.map +1 -1
  432. package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.d.ts +45 -2
  433. package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.d.ts.map +1 -1
  434. package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.js +45 -2
  435. package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.js.map +1 -1
  436. package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.d.ts +35 -0
  437. package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.d.ts.map +1 -0
  438. package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.js +257 -0
  439. package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.js.map +1 -0
  440. package/dist/esm/security/authorizations/application-access-grants.shared.schemas.d.ts +143 -0
  441. package/dist/esm/security/authorizations/application-access-grants.shared.schemas.d.ts.map +1 -0
  442. package/dist/esm/security/authorizations/application-access-grants.shared.schemas.js +219 -0
  443. package/dist/esm/security/authorizations/application-access-grants.shared.schemas.js.map +1 -0
  444. package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.d.ts.map +1 -1
  445. package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.js.map +1 -1
  446. package/dist/esm/security/authorizations/platform-access-grants.shared.schemas.d.ts +23 -0
  447. package/dist/esm/security/authorizations/platform-access-grants.shared.schemas.d.ts.map +1 -1
  448. package/dist/esm/security/authorizations/platform-access-grants.shared.schemas.js +24 -0
  449. package/dist/esm/security/authorizations/platform-access-grants.shared.schemas.js.map +1 -1
  450. package/dist/esm/security/authorizations/roles.shared.defaults.d.ts.map +1 -1
  451. package/dist/esm/security/authorizations/roles.shared.schemas.d.ts.map +1 -1
  452. package/dist/esm/security/authorizations/roles.shared.utils.d.ts.map +1 -1
  453. package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.d.ts.map +1 -1
  454. package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js.map +1 -1
  455. package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.d.ts.map +1 -1
  456. package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js.map +1 -1
  457. package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.d.ts +57 -0
  458. package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.d.ts.map +1 -1
  459. package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.js +44 -0
  460. package/dist/esm/security/connected-accounts/provider-credentials.shared.schemas.js.map +1 -1
  461. package/dist/esm/security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.d.ts.map +1 -1
  462. package/dist/esm/security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.js.map +1 -1
  463. package/dist/esm/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.d.ts.map +1 -1
  464. package/dist/esm/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.js.map +1 -1
  465. package/dist/esm/security/oauth-clients/oauth-clients.shared.schemas.d.ts.map +1 -1
  466. package/dist/esm/security/oauth-clients/oauth-clients.shared.schemas.js.map +1 -1
  467. package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.d.ts.map +1 -1
  468. package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.d.ts.map +1 -1
  469. package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.js.map +1 -1
  470. package/dist/esm/security/oauth-clients/oauth-resource-server.shared.schemas.d.ts.map +1 -1
  471. package/dist/esm/testing/resource-config-builders.d.ts.map +1 -1
  472. package/dist/esm/testing.d.ts.map +1 -1
  473. package/dist/esm/users/anonymous-user-marketing-metadata.shared.schemas.d.ts.map +1 -1
  474. package/dist/esm/users/anonymous-users.shared.resources-config.schemas.d.ts.map +1 -1
  475. package/dist/esm/users/anonymous-users.shared.schema.d.ts.map +1 -1
  476. package/dist/esm/users/inbound-contacts.shared.resources-config.schemas.d.ts.map +1 -1
  477. package/dist/esm/users/inbound-contacts.shared.schemas.d.ts.map +1 -1
  478. package/dist/esm/users/user-credentials.shared.resources-config.schemas.d.ts.map +1 -1
  479. package/dist/esm/users/user-credentials.shared.schemas.d.ts.map +1 -1
  480. package/dist/esm/users/user-identity-links.shared.resources-config.schemas.d.ts.map +1 -1
  481. package/dist/esm/users/user-identity-links.shared.schemas.d.ts.map +1 -1
  482. package/dist/esm/users/user-preferences-reset.shared.utils.d.ts.map +1 -1
  483. package/dist/esm/users/user-preferences.shared.resources-config.schemas.d.ts.map +1 -1
  484. package/dist/esm/users/user-profiles.shared.resources-config.schemas.d.ts.map +1 -1
  485. package/dist/esm/users/user-self-preferences.shared.resources-config.schemas.d.ts.map +1 -1
  486. package/dist/esm/users/user-self-profiles.shared.resources-config.schemas.d.ts.map +1 -1
  487. package/dist/esm/users/user-self.shared.resources-config.schemas.d.ts.map +1 -1
  488. package/dist/esm/users/user-self.shared.resources-config.schemas.js.map +1 -1
  489. package/dist/esm/users/users.shared.resources-config.schemas.d.ts.map +1 -1
  490. package/dist/esm/users/users.shared.resources-config.schemas.js.map +1 -1
  491. package/dist/esm/users/users.shared.schemas.d.ts +17 -1
  492. package/dist/esm/users/users.shared.schemas.d.ts.map +1 -1
  493. package/dist/esm/users/users.shared.schemas.js +18 -2
  494. package/dist/esm/users/users.shared.schemas.js.map +1 -1
  495. package/dist/tsconfig.build.tsbuildinfo +1 -1
  496. package/package.json +4 -4
package/dist/esm/resources/resources-config.shared.factory.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"resources-config.shared.factory.js","sourceRoot":"","sources":["../../../../src/resources/resources-config.shared.factory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,uBAAuB,EAEvB,yBAAyB,EACzB,yBAAyB,EACzB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,YAAY,EACZ,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/J,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,6DAA6D,CAAC;AAC5G;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAClK,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,4BAA4B,EAC5B,qCAAqC,EACrC,8CAA8C,GAC/C,MAAM,wDAAwD,CAAC;AAKhE,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,OAAO,EAAE,+BAA+B,EAAE,yBAAyB,EAAE,MAAM,6DAA6D,CAAC;AACzI,OAAO,EACL,qBAAqB,EAKrB,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAEhC,6BAA6B,EAC7B,sCAAsC,EAStC,8BAA8B,EAG9B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EAGT,sCAAsC,GACvC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAgB,MAAM,qCAAqC,CAAC;AAChJ,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACnC,iCAAiC,EACjC,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,oCAAoC,EACpC,iCAAiC,EACjC,oBAAoB,EAEpB,8BAA8B,EAC9B,0CAA0C,EAC1C,mDAAmD,EACnD,oDAAoD,EACpD,kDAAkD,EAClD,qDAAqD,EACrD,iDAAiD,EACjD,oDAAoD,EAEpD,uCAAuC,EACvC,+BAA+B,EAC/B,2BAA2B,EAC5B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,yCAAyC,EAAE,MAAM,wDAAwD,CAAC;AACnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,gCAAgC,EAAE,qCAAqC,EAAE,MAAM,8CAA8C,CAAC;AACvI,OAAO,EAAE,0BAA0B,EAAgC,MAAM,yDAAyD,CAAC;AACnI,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,mCAAmC,GACpC,MAAM,8CAA8C,CAAC;AAEtD,mCAAmC;AACnC,gBAAgB;AAChB,mCAAmC;AAEnC;;;GAGG;AACH;;;;;;;;;;;;;;GAcG;AACH,SAAS,oCAAoC,CAC3C,MAAoB,EACpB,kBAA0B;IAE1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAW,CAAC;IAEnC,MAAM,IAAI,GAAG,CAAC,SAAmC,EAAE,IAAY,EAAE,UAAmB,EAAQ,EAAE;QAC5F,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO;QACjD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEvB,IAAI,CAAC,UAAU,IAAI,yBAAyB,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,YAAY,IAAI,2DAA2D;gBACjG,oGAAoG;gBACpG,gCAAgC,IAAI,mEAAmE;gBACvG,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,WAA2B,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC;IAEF,uFAAuF;IACvF,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,SAAS,GAAG,YAAY,CAAC,WAA2B,CAAC,IAAK,WAA4B,CAAC;QAC7F,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,WAA2B,EAAE,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,KAAa,CAAC,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,KAAa,CAAC,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,+BAA+B,CAAC,WAAyC;IAChF,OAAO,mCAAmC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gDAAgD,GAIhD;IACJ;QACE,SAAS,EAAE,qBAAqB,CAAC,WAAW;QAC5C,SAAS,EAAE,oBAAoB;QAC/B,GAAG,EAAE,sEAAsE;KAC5E;IACD;QACE,SAAS,EAAE,qBAAqB,CAAC,IAAI;QACrC,SAAS,EAAE,sBAAsB;QACjC,GAAG,EAAE,gGAAgG;KACtG;IACD;QACE,SAAS,EAAE,qBAAqB,CAAC,IAAI;QACrC,SAAS,EAAE,sBAAsB;QACjC,GAAG,EAAE,wFAAwF;KAC9F;CACF,CAAC;AAEF,SAAS,6BAA6B,CAAC,KAAa,EAAE,KAAa,EAAE,SAAiB;IACpF,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,wBAAwB,CAC5B,cAAc,SAAS,gBAAgB,KAAK,KAAK,KAAK,2DAA2D,CAClH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,yCAAyC,CAChD,UAAiB,EACjB,qBAA6C,EAC7C,kBAAgC,EAChC,2BAA2F;IAE3F,MAAM,wBAAwB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/D,+BAA+B,CAAC,SAAS,CAAC,WAAW,CAAC;WACnD,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,MAAM;WAC9D,iBAAiB,IAAI,SAAS;WAC9B,SAAS,CAAC,eAAe,KAAK,IAAI,CACtC,CAAC;IAEF,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,0GAA0G,wBAAwB,CAAC,MAAM,EAAE,CAClK,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,uBAAuB,CAAC,GAAG,wBAAwB,CAAC;IAE3D,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,mBAAmB,GAAU,EAAE,CAAC;IACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CACvC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CACrE,CAAC;IAEF,KAAK,MAAM,YAAY,IAAI,qBAAqB,EAAE,CAAC;QACjD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,4CAA4C,CAC1F,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,CAC5B,CAAC,eAAe,CAAC;QAClB,MAAM,cAAc,GAAG,qBAAqB,CAAC,gDAAgD,CAC3F,YAAY,EACZ,kBAAkB,CACnB,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,wCAAwC,CACxF,MAAM,EACN,iBAAiB,CAClB,CAAC;YAEF,IAAI,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,4CAA4C,mBAAmB,kDAAkD,CACxI,CAAC;YACJ,CAAC;YAED,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAEnD,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;gBACvB,QAAQ,MAAM,EAAE,CAAC;oBACf,KAAK,8BAA8B,CAAC,GAAG;wBACrC,OAAO,iDAAiD,CAAC;oBAC3D,KAAK,8BAA8B,CAAC,KAAK;wBACvC,OAAO,mDAAmD,CAAC;oBAC7D,KAAK,8BAA8B,CAAC,MAAM;wBACxC,OAAO,oDAAoD,CAAC;oBAC9D,KAAK,8BAA8B,CAAC,IAAI;wBACtC,OAAO,kDAAkD,CAAC;oBAC5D,KAAK,8BAA8B,CAAC,MAAM;wBACxC,OAAO,oDAAoD,CAAC;oBAC9D,KAAK,8BAA8B,CAAC,OAAO;wBACzC,OAAO,qDAAqD,CAAC;gBACjE,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YAEL,mBAAmB,CAAC,IAAI,CAAC;gBACvB,GAAG,uBAAuB;gBAC1B,mBAAmB;gBACnB,SAAS,EAAE,KAAK;gBAChB,kBAAkB,EAAE,KAAK;gBACzB,eAAe,EAAE,IAAI;gBACrB,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;gBACxD,UAAU;gBACV,wEAAwE;gBACxE,mEAAmE;gBACnE,mBAAmB,EAAE,IAAI;gBACzB,WAAW,EAAE,0CAA0C;gBACvD,oBAAoB,EAAE,IAAI;gBAC1B,oBAAoB,EAAE,SAAS;gBAC/B,2BAA2B,EAAE,EAAE;gBAC/B,iBAAiB,EAAE,EAAE;gBACrB,gBAAgB,EAAE,EAAE;gBACpB,eAAe,EAAE,SAAS;gBAC1B,eAAe,EAAE,SAAS;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,sBAAgE,EAChE,wBAAgD,EAChD,2BAA2F;IAE3F,KAAK,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC3F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,SAAS;QACX,CAAC;QAED,MAAM,mBAAmB,GAAG,YAA4B,CAAC;QACzD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,UAAU,CAAC,MAAM,CACpE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,wCAAwC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CACtH,CAAC;QACF,MAAM,qBAAqB,GAAG,wBAAwB,CAAC,MAAM,CAC3D,CAAC,YAAY,EAAE,EAAE,CACf,YAAY,CAAC,aAAa,KAAK,mBAAmB;eAC/C,YAAY,CAAC,aAAa,KAAK,mBAAmB,CACxD,CAAC;QAEF,qBAAqB,CAAC,UAAU,GAAG;YACjC,GAAG,sBAAsB;YACzB,GAAG,yCAAyC,CAC1C,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,CAC5B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,yCAAyC,CAAC,MAGlD;IACC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CACvC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAC5E,CAAC;IAEF,MAAM,gBAAgB,GAAU,EAAE,CAAC;IAEnC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAI,SAAmE,CAAC,gBAAgB,CAAC;QAC3G,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QAED,MAAM,yBAAyB,GAAG,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAExE,IAAI,CAAC,+BAA+B,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gBAAgB,yBAAyB,uFAAuF,CAC9J,CAAC;QACJ,CAAC;QAED,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,mBAAmB,GAAG,CAAC,SAAS,CAAC,qBAAqB,IAAI,SAAS,CAAC,mBAAmB,CAA0B,CAAC;QACxH,IAAI,mBAAmB,KAAK,qBAAqB,CAAC,IAAI,IAAI,mBAAmB,KAAK,qBAAqB,CAAC,MAAM,EAAE,CAAC;YAC/G,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gBAAgB,yBAAyB,wFAAwF,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAC7L,CAAC;QACJ,CAAC;QAED,sFAAsF;QACtF,6EAA6E;QAC7E,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gBAAgB,yBAAyB,sGAAsG,CAC7K,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnE,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gBAAgB,yBAAyB,wGAAwG,CAC/K,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,CAAC,mBAAmB,KAAK,SAAS,IAAI,YAAY,CAAC,mBAAmB,IAAI,CAAC,EAAE,CAAC;YAC5F,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gBAAgB,yBAAyB,wFAAwF,CAC/J,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,iDAAiD,CAAC,yBAAyB,CAAC,CAAC;QAC/H,IAAI,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvD,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,4CAA4C,mBAAmB,kDAAkD,CAC/I,CAAC;QACJ,CAAC;QACD,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAEnD,gBAAgB,CAAC,IAAI,CAAC;YACpB,GAAG,SAAS;YACZ,mBAAmB;YACnB,SAAS,EAAE,KAAK;YAChB,kBAAkB,EAAE,KAAK;YACzB,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,UAAU,CAAC,GAAG;YACxB,uFAAuF;YACvF,+FAA+F;YAC/F,qBAAqB,EAAE,mBAAmB;YAC1C,kBAAkB,EAAE;gBAClB,IAAI,EAAE,8BAA8B,CAAC,2BAA2B;gBAChE,yBAAyB;gBACzB,mBAAmB;gBACnB,MAAM,EAAE,YAAY;aACrB;YACD,gGAAgG;YAChG,+FAA+F;YAC/F,WAAW,EAAE,sCAAsC;YACnD,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,0DAA0D;YAC1D,GAAG,EAAE,SAAS;YACd,gBAAgB,EAAE,SAAS;YAC3B,oBAAoB,EAAE,SAAS;YAC/B,2BAA2B,EAAE,EAAE;YAC/B,iBAAiB,EAAE,EAAE;YACrB,gBAAgB,EAAE,EAAE;YACpB,eAAe,EAAE,SAAS;YAC1B,eAAe,EAAE,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,uCAAuC,CAAC,MAOhD;IACC,MAAM,4BAA4B,GAAG,MAAM,CAAC,4BAA4B,IAAI,MAAM,CAAC,UAAU,CAAC;IAC9F,MAAM,eAAe,GAAG,gCAAgC,CAAC,4BAA4B,CAAC,CAAC;IACvF,MAAM,oBAAoB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,4FAA4F,oBAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3L,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAC5C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAChC,CAAC;IACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwDG;IACH,MAAM,0CAA0C,GAAqC;QACnF,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI;QAClC,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,IAAI;QACrC,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,KAAK;QACzC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,KAAK;KACrC,CAAC;IACF,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,eAAe,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAClD,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,eAAe,CAAC;eACnE,0BAA0B,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;QAC7F,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAChC,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,8FAA8F;kBACzH,8EAA8E;kBAC9E,uBAAuB,MAAM,CAAC,eAAe,CAAC,gBAAgB;kBAC9D,IAAI,kBAAkB,CAAC,OAAO,OAAO,kBAAkB,CAAC,UAAU,2DAA2D;kBAC7H,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/D,+BAA+B,CAAC,SAAS,CAAC,WAAW,CAAC;WACnD,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,MAAM;WAC9D,iBAAiB,IAAI,SAAS;WAC9B,SAAS,CAAC,eAAe,KAAK,IAAI;WAClC,SAAS,CAAC,kBAAkB,KAAK,IAAI,CACzC,CAAC;IACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gGAAgG,CAC9H,CAAC;IACJ,CAAC;IAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CACvC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAC5E,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,4BAA4B;KACvC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QAC3C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,+CAA+C,CAAC,SAAS,CAAC,CAAC;QAC7G,IAAI,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvD,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,0CAA0C,mBAAmB,kDAAkD,CAC7I,CAAC;QACJ,CAAC;QACD,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAEnD,OAAO;YACL,GAAG,mBAAmB;YACtB,mBAAmB;YACnB,SAAS,EAAE,KAAK;YAChB,kBAAkB,EAAE,KAAK;YACzB,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,UAAU,CAAC,IAAI;YACzB,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;YACnD,kBAAkB,EAAE;gBAClB,IAAI,EAAE,8BAA8B,CAAC,yBAAyB;gBAC9D,SAAS;aACV;YACD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,6EAA6E;YAC7E,4EAA4E;YAC5E,6CAA6C;YAC7C,mBAAmB,EAAE,IAAI;YACzB,WAAW;YACX,WAAW,EAAE,WAAW;YACxB,oBAAoB,EAAE,IAAI;YAC1B,oBAAoB,EAAE,SAAS;YAC/B,2BAA2B,EAAE,EAAE;YAC/B,iBAAiB,EAAE,EAAE;YACrB,gBAAgB,EAAE,EAAE;YACpB,eAAe,EAAE,SAAS;YAC1B,eAAe,EAAE,SAAS;SAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC,MAAM,6BAA6B,GAAuC,IAAI,GAAG,CAAC;IAChF,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC,CAAC;AACH,MAAM,8CAA8C,GAAuC,IAAI,GAAG,CAAC;IACjG,GAAG,6BAA6B;IAChC,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;CAC5B,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAClC,mBAA4B;IAE5B,OAAO,6BAA6B,CAAC,GAAG,CACtC,mBAA4C,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,mBAA4B;IAE5B,OAAO,8CAA8C,CAAC,GAAG,CACvD,mBAA4C,CAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,6BAA6B,CACpC,MAA6B,EAC7B,kBAA0B,EAC1B,mBAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,kBAAkB,IAAI,mBAAmB,mBAAmB,CAAC;IAEhF,iCAAiC;IACjC,IAAI,MAAM,CAAC,eAAe,KAAK,+BAA+B,CAAC,aAAa,EAAE,CAAC;QAC7E,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,wBAAwB,CAC5B,GAAG,MAAM,qDAAqD,MAAM,CAAC,OAAO,IAAI,SAAS,IAAI;gBAC7F,iDAAiD,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,MAAM,CAAC,eAAe,KAAK,+BAA+B,CAAC,aAAa,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACvG,MAAM,wBAAwB,CAC5B,GAAG,MAAM,qBAAqB,MAAM,CAAC,OAAO,4BAA4B,MAAM,CAAC,eAAe,IAAI;YAClG,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,wBAAwB,CAAC,GAAG,MAAM,0BAA0B,CAAC,CAAC;IACtE,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,wBAAwB,CAAC,GAAG,MAAM,6DAA6D,CAAC,CAAC;IACzG,CAAC;IAED,iFAAiF;IACjF,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,wBAAwB,CAAC,GAAG,MAAM,kCAAkC,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,oBAAoB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,wBAAwB,CAC5B,GAAG,MAAM,2DAA2D;YACpE,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrD,MAAM,wBAAwB,CAC5B,GAAG,MAAM,wBAAwB,MAAM,CAAC,SAAS,2CAA2C;YAC5F,mDAAmD,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,6BAA6B,CACpC,MAA6B,EAC7B,kBAA0B,EAC1B,mBAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,kBAAkB,IAAI,mBAAmB,mBAAmB,CAAC;IAEhF,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,wBAAwB,CAAC,GAAG,MAAM,kEAAkE,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED,mCAAmC;AACnC,kCAAkC;AAClC,mCAAmC;AAEnC;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,KAAyC;IAC1E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,wDAAwD;QACxD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,CAAU,CAAC;AAC5H,+EAA+E;AAE/E,4GAA4G;AAE5G;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAa,EACb,gBAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAiC,EAAE,CAAC;QAErD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,WAA2B,CAAC;YAEhD,gCAAgC;YAChC,IAAK,qBAA2C,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAE/E,wEAAwE;YACxE,IAAK,+BAAqD,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAEzF,gDAAgD;YAChD,IAAI,cAAc,CAAC,WAAW,CAAC;gBAAE,SAAS;YAE1C,mCAAmC;YACnC,IAAI,oBAAoB,CAAC,WAAW,CAAC;gBAAE,SAAS;YAEhD,wEAAwE;YACxE,uDAAuD;YACvD,IAAI,sBAAsB,CAAC,WAAW,CAAC;gBAAE,SAAS;YAElD,mDAAmD;YACnD,oEAAoE;YACpE,oEAAoE;YAEpE,8EAA8E;YAC9E,wDAAwD;YACxD,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC;gBAAE,SAAS;YAExF,4BAA4B;YAC5B,IAAI,gBAAgB,EAAE,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAEpD,WAAW,CAAC,SAAS,CAAC,GAAG,qCAAqC,CAAC,WAA2B,CAAC,CAAC;QAC9F,CAAC;QAED,OAAO,qCAAqC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;QAC3C,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC;AAKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,qBAAqB,CAC5B,UAAa,EACb,gBAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAiC,EAAE,CAAC;QAErD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,WAA2B,CAAC;YAEhD,gCAAgC;YAChC,IAAK,qBAA2C,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAE/E,uEAAuE;YACvE,IAAK,+BAAqD,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAEzF,gDAAgD;YAChD,IAAI,cAAc,CAAC,WAAW,CAAC;gBAAE,SAAS;YAE1C,mCAAmC;YACnC,IAAI,oBAAoB,CAAC,WAAW,CAAC;gBAAE,SAAS;YAEhD,oEAAoE;YACpE,8DAA8D;YAC9D,IAAI,sBAAsB,CAAC,WAAW,CAAC;gBAAE,SAAS;YAElD,mDAAmD;YACnD,oEAAoE;YACpE,kEAAkE;YAElE,wDAAwD;YACxD,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS;gBAAE,SAAS;YAElD,4BAA4B;YAC5B,IAAI,gBAAgB,EAAE,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAEpD,0EAA0E;YAC1E,uEAAuE;YACvE,2DAA2D;YAC3D,WAAW,CAAC,SAAS,CAAC,GAAG,oBAAoB,CAC3C,qCAAqC,CAAC,WAA2B,CAAC,CACnE,CAAC;QACJ,CAAC;QAED,OAAO,qCAAqC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;QAC3C,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,UAAa,EACb,WAA0B;IAE1B,8DAA8D;IAC9D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,qCAAqC,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IAED,sCAAsC;IACtC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,qBAAqB,CAAC,MAAM;YAC/B,OAAO,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAC3C,KAAK,qBAAqB,CAAC,MAAM;YAC/B,OAAO,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAC3C,KAAK,qBAAqB,CAAC,IAAI,CAAC;QAChC,KAAK,qBAAqB,CAAC,MAAM;YAC/B,8DAA8D;YAC9D,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB;YACE,kEAAkE;YAClE,0DAA0D;YAC1D,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,mCAAmC;AACnC,mCAAmC;AACnC,mCAAmC;AAEnC;;;;;;;;;;GAUG;AACH,SAAS,6BAA6B,CACpC,UAAwB,EACxB,kBAA0B;IAE1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAE5C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,WAA2B,CAAC;YAEhD,mDAAmD;YACnD,IAAI,cAAc,CAAC,WAAW,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CACT,UAAU,SAAS,0DAA0D;oBAC7E,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YAED,wDAAwD;YACxD,IAAI,oBAAoB,CAAC,WAAW,CAAC,IAAI,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3E,MAAM,CAAC,IAAI,CACT,UAAU,SAAS,+DAA+D;oBAClF,wFAAwF,CACzF,CAAC;YACJ,CAAC;YAED,oFAAoF;YACpF,uEAAuE;QACzE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;QAC/C,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,wBAAwB,CAC5B,aAAa,kBAAkB,yCAAyC;YACxE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/C,CAAC;IACJ,CAAC;AACH,CAAC;AAuBD,mCAAmC;AACnC,mBAAmB;AACnB,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,SAAS,8BAA8B,CACrC,qBAA6C,EAC7C,kBAAgC;IAKhC,4FAA4F;IAC5F,kGAAkG;IAClG,8FAA8F;IAC9F,uEAAuE;IACvE,EAAE;IACF,sFAAsF;IACtF,+FAA+F;IAC/F,EAAE;IACF,iGAAiG;IACjG,0FAA0F;IAC1F,gEAAgE;IAChE,0DAA0D;IAC1D,2CAA2C;IAC3C,EAAE;IACF,8EAA8E;IAC9E,sFAAsF;IACtF,oCAAoC;IACpC,sFAAsF;IAEtF,4DAA4D;IAC5D,uFAAuF;IACvF,qFAAqF;IACrF,+DAA+D;IAC/D,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEjF,MAAM,YAAY,GAAG,CAAC,GAAyB,EAAE,EAAE,CACjD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CAAC;IAExB,MAAM,8BAA8B,GAAgD;QAClF,kFAAkF;QAClF,oFAAoF;QACpF,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpD,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACnB;QACD,kBAAkB,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnD,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACnB;QACD,kEAAkE;QAClE,kFAAkF;QAClF,yEAAyE;QACzE,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClD,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACpF,CAAC,YAAY,CAAC,GAAG,CAAC,CACnB;KACF,CAAC;IAEF,2CAA2C;IAC3C,oDAAoD;IACpD,2CAA2C;IAE3C,MAAM,4BAA4B,GAAG,CACnC,uBAAwD,EAClC,EAAE,CACxB,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAEhF;;;;;;;;;;;OAWG;IACH,MAAM,0BAA0B,GAAG,CACjC,SAAuB,EACvB,UAAwB,EACxB,QAAsB,EACtB,UAAmB,EACG,EAAE,CACxB,4BAA4B,CAAC;QAC3B,YAAY,EAAE,+BAA+B,CAAC,GAAG,EAAG,cAAc;QAClE,YAAY,EAAE,+BAA+B,CAAC,IAAI,EAAE,iBAAiB;QACrE,aAAa,EAAE,SAAS,EAAK,oCAAoC;QACjE,aAAa,EAAE,UAAU,EAAI,6CAA6C;QAC1E,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;QACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;QAC7E,cAAc,EAAE,KAAK;QACrB,UAAU;QACV,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,QAAQ;QAC1B,iBAAiB,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC;KAC9E,CAAC,CAAC;IAEL,4FAA4F;IAC5F,2EAA2E;IAC3E,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/D,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CACtB,CAAC;IAEF,6EAA6E;IAC7E,MAAM,uBAAuB,GAA2B,EAAE,CAAC;IAE3D,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACvC,qBAAqB,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;QAE9G,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAC7C,2CAA2C;YAC3C,yDAAyD;YACzD,2CAA2C;YAC3C,wEAAwE;YACxE,gDAAgD;YAChD,yCAAyC;YACzC,4EAA4E;YAC5E,EAAE;YACF,iFAAiF;YACjF,sFAAsF;YACtF,iFAAiF;YACjF,+EAA+E;YAC/E,qFAAqF;YACrF,yEAAyE;YAEzE,iFAAiF;YACjF,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG,EAAG,cAAc;gBAClE,YAAY,EAAE,+BAA+B,CAAC,IAAI,EAAE,qBAAqB;gBACzE,aAAa,EAAE,WAAW,EAAS,gCAAgC;gBACnE,aAAa,EAAE,kBAAkB,EAAE,8CAA8C;gBACjF,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,yEAAyE;gBACzE,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,uBAAuB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAElD,sFAAsF;YACtF,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG,EAAG,cAAc;gBAClE,YAAY,EAAE,+BAA+B,CAAC,IAAI,EAAE,qBAAqB;gBACzE,aAAa,EAAE,WAAW,EAAS,wBAAwB;gBAC3D,aAAa,EAAE,kBAAkB,EAAE,8CAA8C;gBACjF,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB,EAAE,0BAA0B;gBACzG,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,yEAAyE;gBACzE,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,0FAA0F;gBAC1F,eAAe,EAAE,eAAe;aACjC,CAAC,CAAC;YACH,uBAAuB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAEpD,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,2CAA2C;YAC3C,oEAAoE;YACpE,2CAA2C;YAC3C,iEAAiE;YACjE,gFAAgF;YAChF,iFAAiF;YACjF,+EAA+E;YAC/E,6EAA6E;YAE7E,IAAI,CAAC,iBAAiB;gBACpB,MAAM,wBAAwB,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YAEtI,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG,EAAG,aAAa;gBACjE,YAAY,EAAE,+BAA+B,CAAC,IAAI,EAAE,qBAAqB;gBACzE,aAAa,EAAE,kBAAkB,EAAI,iBAAiB;gBACtD,aAAa,EAAE,iBAAiB,EAAK,iBAAiB;gBACtD,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,uBAAuB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAE9C,0EAA0E;YAC1E,4EAA4E;YAC5E,uBAAuB,CAAC,IAAI,CAC1B,0BAA0B,CAAC,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,CAC3G,CAAC;QAEJ,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,2CAA2C;YAC3C,qEAAqE;YACrE,2CAA2C;YAC3C,sEAAsE;YACtE,4EAA4E;YAC5E,+EAA+E;YAE/E,IAAI,CAAC,iBAAiB;gBACpB,MAAM,wBAAwB,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YAEtI,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG,EAAG,aAAa;gBACjE,YAAY,EAAE,+BAA+B,CAAC,IAAI,EAAE,qBAAqB;gBACzE,aAAa,EAAE,kBAAkB,EAAI,iBAAiB;gBACtD,aAAa,EAAE,iBAAiB,EAAK,iBAAiB;gBACtD,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,eAAe;gBAChC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,uBAAuB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAE9C,0EAA0E;YAC1E,4EAA4E;YAC5E,uBAAuB,CAAC,IAAI,CAC1B,0BAA0B,CAAC,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACpC,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,EAAE,CAAC;YACzF,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;aAAM,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,EAAE,CAAC;YAChG,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9D,CAAC;aAAM,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,EAAE,CAAC;YAChG,8BAA8B,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,qFAAqF;IACrF,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;QAC3C,GAAG,8BAA8B,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;QACnF,GAAG,8BAA8B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;KAClF,CAAC,CAAC;IAEH,OAAO;QACL,8BAA8B;QAC9B,4BAA4B;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,iDAAiD,CACxD,qBAAkE,EAClE,4BAA+C,EAC/C,0CAA0I,EAC1I,mBAA2B;IAE3B,IAAI,CAAC,0CAA0C,IAAI,0CAA0C,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3G,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,qEAAqE;IACrE,KAAK,MAAM,QAAQ,IAAI,0CAA0C,EAAE,CAAC;QAClE,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7D,MAAM,wBAAwB,CAAC,cAAc,mBAAmB,6DAA6D,QAAQ,CAAC,YAAY,kDAAkD,CAAC,CAAC;QACxM,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAyD,CAAC;IACrF,0CAA0C,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QAC5D,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,CAAC,GAAyB,EAAwB,EAAE;QACxE,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC5D,OAAO,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAClG,CAAC,CAAC;IAEF,MAAM,4BAA4B,GAAgD;QAChF,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC;QACjF,kBAAkB,EAAE,CAAC,GAAG,qBAAqB,CAAC,kBAAkB,CAAC;QACjE,2EAA2E;QAC3E,iBAAiB,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC;KAC9E,CAAC;IAEF,OAAO,4BAA4B,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,iBAA+E,EAC/E,kBAAgC,EAChC,mBAA2B,EAC3B,oBAA0C;IAG1C,2CAA2C;IAC3C,0CAA0C;IAC1C,2CAA2C;IAE3C,2DAA2D;IAC3D,MAAM,4BAA4B,GAAG,IAAI,GAAG,EAAwE,CAAC;IACrH,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,4BAA4B,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,KAAK,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,IAAI,4BAA4B,CAAC,OAAO,EAAE,EAAE,CAAC;QACpF,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC9B,4CAA4C;YAC5C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;YACxE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,wBAAwB,CAC5B,cAAc,kBAAkB,IAAI,mBAAmB,SAAS,aAAa,CAAC,MAAM,uCAAuC,aAAa,KAAK;oBAC7I,6HAA6H;oBAC7H,GAAG,WAAW,CAAC,MAAM,qDAAqD,CAC3E,CAAC;YACJ,CAAC;YAED,mDAAmD;YACnD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;YAC7D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpC,MAAM,wBAAwB,CAC5B,cAAc,kBAAkB,IAAI,mBAAmB,oEAAoE,aAAa,KAAK;oBAC7I,mFAAmF;oBACnF,gBAAgB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,uBAAuB;IACvB,2CAA2C;IAE3C,OAAO,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE;QAC1C,2IAA2I;QAC3I,MAAM,eAAe,GAAG;YACtB,kBAAkB;YAClB,mBAAmB;YACnB,YAAY,CAAC,MAAM;SACpB,CAAC;QAEF,4DAA4D;QAC5D,IAAI,YAAY,CAAC,qBAAqB,EAAE,CAAC;YACvC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QAED,2BAA2B;QAC3B,IAAI,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,uBAAuB;QACvB,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;YACvB,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,uBAAuB,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE1D,OAAO;YACL,GAAG,YAAY;YACf,UAAU,EAAE,uBAAuB;YACnC,YAAY,EAAE,oBAAoB;SACnC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,gBAA8D,EAC9D,kBAAgC,EAChC,mBAA2B;IAE3B,OAAO,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE;QACzC,kFAAkF;QAClF,MAAM,uBAAuB,GAAG;YAC9B,kBAAkB;YAClB,mBAAmB;YACnB,YAAY,CAAC,OAAO;SACrB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,OAAO;YACL,GAAG,YAAY;YACf,UAAU,EAAE,uBAAuB;SACpC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAGnC,SAAS,qCAAqC,CAAyB,MAItE;IAEC,MAAM,EACJ,UAAU,EACV,wBAAwB,GAAG,IAAI,EAC/B,sBAAsB,GAAG,EAAE,EAC5B,GAAG,MAAM,CAAC;IAEX,qCAAqC;IACrC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,wBAAwB,CAAC,yDAAyD,CAAC,CAAC;IAC5F,CAAC;IAED,mEAAmE;IACnE,IAAI,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;QACtC,OAAO,UAAU,CAAC,SAAS,KAAK,UAAU;QAC1C,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,wBAAwB,CAAC,qDAAqD,OAAO,UAAU,kBAAkB,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1J,CAAC;IAED,IAAI,wBAAwB,EAAE,CAAC;QAC7B,IAAI,OAAO,sBAAsB,KAAK,QAAQ,IAAI,sBAAsB,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,wBAAwB,CAAC,0DAA0D,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,MAAM,qBAAqB,GAAG,CAAC,MAAS,EAAE,EAAE;QAC1C,IAAI,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAElC,IAAI,wBAAwB,EAAE,CAAC;YAC7B,IAAI,sBAAsB,GAAG,CAAC,EAAE,CAAC;gBAC/B,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,sBAAsB,EAAE,uCAAuC,sBAAsB,QAAQ,CAAC,CAAC;YAC/H,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,uDAAuD;IACvD,MAAM,yBAAyB,GAAG,CAAC,KAAU,EAAqD,EAAE;QAClG,0BAA0B;QAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,qBAAqB,CAAC,sCAAsC,CAAC,CAAC;QACtE,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QAC7E,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,qBAAqB,CAAC,6BAA6B,CAAC,CAAC;QAC7D,CAAC;QAED,wCAAwC;QACxC,IAAI,wBAAwB,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;gBAC/C,MAAM,qBAAqB,CAAC,uCAAuC,sBAAsB,eAAe,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/H,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,qBAAqB,CAAC,mDAAmD,CAAC,CAAC;QACnF,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC9D,MAAM,qBAAqB,CAAC,oCAAoC,CAAC,CAAC;QACpE,CAAC;QAED,sCAAsC;QACtC,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAC1E,KAAK,MAAM,KAAK,IAAI,wBAAwB,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,qBAAqB,CAAC,2BAA2B,KAAK,SAAS,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAChD,MAAM,qBAAqB,CAAC,eAAe,KAAK,oBAAoB,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,qBAAqB,CAAC,eAAe,KAAK,wBAAwB,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YAC3F,MAAM,qBAAqB,CAAC,wCAAwC,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,qBAAqB,CAAC,mCAAmC,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,yDAAyD;IACzD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;QAC5B,IAAI,EAAE,qBAAqB,CAAC,UAAU,CAAC;QACvC,8FAA8F;QAC9F,uFAAuF;QACvF,UAAU,EAAE,sCAAsC,CAAC,sBAAsB,CAAC;KAC3E,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE;QACnC,OAAO,EAAE,sCAAsC;KAChD,CAAC,CAAC;IAEH,OAAO,YAAmE,CAAC;AAC7E,CAAC;AAID,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sCAAsC,CAGpD,MAgBD;IAEC,MAAM,EAAE,YAAY,EAAE,iBAAiB,GAAG,EAAE,EAAE,UAAU,GAAG,IAAI,EAAE,8BAA8B,EAAE,GAAG,MAAM,CAAC;IAE3G,4BAA4B;IAC5B,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,wBAAwB,CAAC,iCAAiC,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3D,MAAM,wBAAwB,CAAC,sCAAsC,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1I,MAAM,wBAAwB,CAAC,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IAED,wCAAwC;IACxC,MAAM,kBAAkB,GAAG,CAA6C,MAAS,EAAE,EAAE;QACnF,MAAM,eAAe,GAAuC,EAAE,CAAC;QAE/D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE;YAC/C,mDAAmD;YACnD,IAAI,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;gBAChC,eAAe,CAAC,GAAG,CAAC,GAAG,gCAAgC,CAAC,QAAQ,EAAE,CAAC;YACrE,CAAC;iBAAM,IAAI,MAAM,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;gBACzC,eAAe,CAAC,GAAG,CAAC,GAAI,MAAsB,CAAC,QAAQ,EAAE,CAAC;YAC5D,CAAC;iBAAM,IAAI,MAAM,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;gBACzC,eAAe,CAAC,GAAG,CAAC,GAAI,MAAsB,CAAC,QAAQ,EAAE,CAAC;YAC5D,CAAC;iBAAM,IAAI,MAAM,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC1C,eAAe,CAAC,GAAG,CAAC,GAAI,MAAuB,CAAC,QAAQ,EAAE,CAAC;YAC7D,CAAC;iBAAM,IAAI,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;gBACvC,eAAe,CAAC,GAAG,CAAC,GAAI,MAAyB,CAAC,QAAQ,EAAE,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,qCAAqC;gBACrC,eAAe,CAAC,GAAG,CAAC,GAAI,MAAuB,CAAC,QAAQ,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,2BAA2B,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7D,CAAC,CAAC;IAEF,yCAAyC;IACzC,MAAM,mBAAmB,GAAG,CAAC,MAAyB,EAAE,EAAE;QACxD,MAAM,aAAa,GAAoD,EAAE,CAAC;QAE1E,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YACrB,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC9B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;gBACvB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC;gBAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC,CAAC;IAGF,mDAAmD;IACnD,MAAM,YAAY,GAAQ,EAAE,CAAC;IAE7B,6BAA6B;IAC7B,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,2FAA2F;IAC3F,6FAA6F;IAC7F,IAAI,UAAU,EAAE,CAAC;QACf,YAAY,CAAC,UAAU,GAAG,6BAA6B,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrG,CAAC;IAED,6CAA6C;IAC7C,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,YAAY,CAAC,OAAO,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAChE,CAAC;IAED,uCAAuC;IACvC,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,YAAY,CAAC,OAAO,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,OAAO,GAAG,2BAA2B,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,0CAA0C;IAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAE5C,OAAO,YAA4E,CAAC;AACtF,CAAC;AAMD,4DAA4D;AAC5D,SAAS,8BAA8B,CAAC,SAAiB;IACvD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,qBAAqB,CAAC,IAAI,CAAC;QAChC,KAAK,qBAAqB,CAAC,IAAI,CAAC;QAChC,KAAK,qBAAqB,CAAC,MAAM,CAAC;QAClC,KAAK,qBAAqB,CAAC,KAAK;YAC9B,OAAO,UAAU,CAAC,GAAG,CAAC;QACxB,KAAK,qBAAqB,CAAC,MAAM,CAAC;QAClC,KAAK,qBAAqB,CAAC,WAAW;YACpC,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,KAAK,qBAAqB,CAAC,MAAM,CAAC;QAClC,KAAK,qBAAqB,CAAC,WAAW;YACpC,OAAO,UAAU,CAAC,GAAG,CAAC;QACxB,KAAK,qBAAqB,CAAC,MAAM,CAAC;QAClC,KAAK,qBAAqB,CAAC,WAAW;YACpC,OAAO,UAAU,CAAC,MAAM,CAAC;QAC3B;YACE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,iCAAiC;IAC7D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,gCAAgC,CACvC,kBAAmF,EACnF,cAA6E;IAE7E,+EAA+E;IAC/E,mFAAmF;IACnF,qFAAqF;IACrF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,cAAc,CAAC,SAAS,KAAK,KAAK,CAAC;IAC5C,CAAC;IAED,sEAAsE;IACtE,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC/D,OAAO,CAAC,SAAS,KAAK,IAAI,CAC3B,CAAC;IAEF,kEAAkE;IAClE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,cAAc,KAAK,sBAAsB,CAAC;IACnD,CAAC;IAED,gGAAgG;IAChG,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC7D,OAAO,CAAC,SAAS,KAAK,KAAK,CAC5B,CAAC;IAEF,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,cAAc,KAAK,oBAAoB,CAAC;IACjD,CAAC;IAED,mFAAmF;IACnF,OAAO,cAAc,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,qBAAqB,CAAC,OAAO;IAC7B,qBAAqB,CAAC,OAAO;CAC9B,CAAC,CAAC;AAEH,SAAS,uCAAuC,CAC9C,SAAiB,EACjB,OAAsE;IAEtE,MAAM,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,IAAI,SAAS,CAAC;IACtE,OAAO,kBAAkB,KAAK,qBAAqB,CAAC,IAAI;WACnD,kBAAkB,KAAK,qBAAqB,CAAC,IAAI;WACjD,kBAAkB,KAAK,qBAAqB,CAAC,MAAM,CAAC;AAC3D,CAAC;AAED,mCAAmC;AACnC,iCAAiC;AACjC,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,UAAU,0CAA0C,CAIxD,MAED;IAEC,MAAM,EACJ,UAAU,EACV,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,GAAG,KAAK;IACxB,gGAAgG;IAChG,+FAA+F;IAC/F,6BAA6B,GAAG,IAAI;IACpC,4EAA4E;IAC5E,yEAAyE;IACzE,sDAAsD;IACtD,iDAAiD;IACjD,4EAA4E;IAC5E,cAAc;IACd,kBAAkB,GAAG;QACnB,IAAI,EAAE,wBAAwB,CAAC,SAAS;QACxC,IAAI,EAAE,wBAAwB,CAAC,SAAS;QACxC,MAAM,EAAE,wBAAwB,CAAC,SAAS;QAC1C,MAAM,EAAE,wBAAwB,CAAC,SAAS;QAC1C,UAAU,EAAE,wBAAwB,CAAC,SAAS;KAC/C,EACD,cAAc,GAAG,KAAK,EACtB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,uBAAuB,GACxB,GAAG,MAAM,CAAC;IAEX;;;;;;;;;;;OAWG;IACH,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACvF,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,kJAAkJ,CACzK,CAAC;IACJ,CAAC;IACD,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,aAAa,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAClG,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,kJAAkJ,CACzK,CAAC;IACJ,CAAC;IACD,IAAI,oBAAoB,KAAK,SAAS,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAClG,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,mEAAmE,MAAM,CAAC,kBAAkB,IAAI,kCAAkC,CAAC,4HAA4H,CACtR,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;QACvF,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,6DAA6D,MAAM,CAAC,kBAAkB,IAAI,kCAAkC,CAAC,gIAAgI,CACpR,CAAC;IACJ,CAAC;IACD;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,IAAI,2BAA2B,KAAK,SAAS,EAAE,CAAC;QACpG,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,oQAAoQ,CAC3R,CAAC;IACJ,CAAC;IACD,wFAAwF;IACxF,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,4FAA4F;IAC5F,MAAM,sBAAsB,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;QAC9E,MAAM,YAAY,GAAG,4BAA4B,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC5E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,yCAAyC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9K,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,oCAAoC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxH,CAAC;QACJ,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC;IAC3B,CAAC,CAAC,EAAE,CAAC;IAEL;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;QACzF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAS,EAAE;YACxC,MAAM,wBAAwB,CAAC,IAAI,kBAAkB,+CAA+C,OAAO,EAAE,CAAC,CAAC;QACjH,CAAC,CAAC;QACF,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,CAAC,gKAAgK,CAAC,CAAC;QAC3K,CAAC;QACD,MAAM,gBAAgB,GAAG,qCAAqC,CAAC,SAAS,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACtG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAK,CAAC;QAC3C,IAAI,CAAC;YACH,8CAA8C,CAAC,WAAW,CAAC,CAAC;YAC5D,oCAAoC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAE,OAAe,EAAgB,EAAE;YAC/E,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,WAAW;gBAAE,MAAM,CAAC,GAAG,OAAO,kBAAkB,SAAS,iCAAiC,CAAC,CAAC;YACjG,IAAI,CAAC,oBAAoB,CAAC,WAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAY,CAAC,EAAE,CAAC;gBAC/E,MAAM,CACJ,GAAG,OAAO,kBAAkB,SAAS,0MAA0M,CAChP,CAAC;YACJ,CAAC;YACD,OAAO,WAAY,CAAC;QACtB,CAAC,CAAC;QAEF,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;QACnG,IAAI,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,yBAAyB,WAAW,CAAC,mBAAmB,iEAAiE,CAAC,CAAC;QACpI,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC;YACxC,MAAM,CACJ,yBAAyB,WAAW,CAAC,mBAAmB,gKAAgK,CACzN,CAAC;QACJ,CAAC;QACD,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,+FAA+F;QAC/F,6FAA6F;QAC7F,YAAY;QACZ,EAAE;QACF,uFAAuF;QACvF,2FAA2F;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,uFAAuF;QACvF,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,MAAM,CACJ,yBAAyB,WAAW,CAAC,mBAAmB,4TAA4T,CACrX,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;YAC7F,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,YAAY,EAAE,CAAC;gBAC7D,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,YAAY,CAAC,YAAY,CAAC,KAAK,YAAY,EAAE,CAAC;oBACnE,MAAM,CACJ,YAAY,KAAK,CAAC,UAAU,qNAAqN,CAClP,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,CAAC,QAAQ,KAAK,yBAAyB,CAAC,kBAAkB,IAAI,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1H,MAAM,CAAC,YAAY,KAAK,CAAC,UAAU,uDAAuD,CAAC,CAAC;gBAC9F,CAAC;gBACD,wFAAwF;gBACxF,0FAA0F;gBAC1F,yFAAyF;gBACzF,0FAA0F;gBAC1F,wFAAwF;gBACxF,2DAA2D;gBAC3D,IACE,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY;uBACjE,KAAK,CAAC,QAAQ,KAAK,yBAAyB,CAAC,IAAI;uBACjD,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,EACxD,CAAC;oBACD,KAAK,CAAC,QAAQ,GAAG,yBAAyB,CAAC,kBAAkB,CAAC;gBAChE,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,UAAU,KAAK,iCAAiC,CAAC,MAAM,EAAE,CAAC;YACxE,8FAA8F;YAC9F,6EAA6E;YAC7E,yFAAyF;YACzF,8FAA8F;YAC9F,4FAA4F;YAC5F,6CAA6C;YAC7C,MAAM,YAAY,GAAyB,IAAI,GAAG,CAAU;gBAC1D,qBAAqB,CAAC,MAAM;gBAC5B,qBAAqB,CAAC,WAAW;aAClC,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;YAC1C,KAAK,MAAM,SAAS,IAAK,cAA4B,EAAE,CAAC;gBACtD,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAC1E,CAAC;YACD,KAAK,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,uBAAuB,IAAI,EAAE,CAA4B,CAAC,EAAE,CAAC;gBACzH,MAAM,QAAQ,GAAI,eAA6E,EAAE,QAAQ,IAAI,EAAE,CAAC;gBAChH,MAAM,mBAAmB,GAAc,QAAQ,CAAC,MAAM,GAAG,CAAC;oBACxD,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,IAAI,YAAY,CAAC;oBAC1E,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBACnB,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;oBACzE,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CACJ,sFAAsF,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,kLAAkL,CAC/S,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,+BAA+B,GAAG,qBAAqB,CAAC,2BAA2B,CACvF,qBAAqB,CACtB,CAAC;IAEF,2CAA2C;IAC3C,kCAAkC;IAClC,2CAA2C;IAE3C,uEAAuE;IACvE,6BAA6B,CAAC,UAAU,EAAE,kBAA4B,CAAC,CAAC;IAExE,2CAA2C;IAC3C,gCAAgC;IAChC,2CAA2C;IAC3C,EAAE;IACF,oEAAoE;IACpE,6EAA6E;IAC7E,EAAE;IACF,2EAA2E;IAC3E,mGAAmG;IACnG,iCAAiC;IACjC,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,8DAA8D;IAC9D,8EAA8E;IAC9E,EAAE;IACF,mEAAmE;IACnE,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,0EAA0E;IAC1E,wDAAwD;IACxD,EAAE;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,sCAAsC;IACtC,EAAE;IACF,0EAA0E;IAC1E,0DAA0D;IAC1D,6DAA6D;IAC7D,2EAA2E;IAC3E,qEAAqE;IACrE,8EAA8E;IAE9E,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAC7E,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,kBAAkB,CAClD,CAAC;IAEF,MAAM,qBAAqB,GAAG,+BAA+B,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzE,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,CACrF,CAAC;IACF,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC;IAEhG,IAAI,oBAA0C,CAAC;IAC/C,IAAI,cAAc,EAAE,CAAC;QACnB,oBAAoB,GAAG,cAAc,CAAC,CAAC,CAAyB,CAAC;IACnE,CAAC;SAAM,IAAI,wBAAwB,EAAE,YAAY,EAAE,CAAC;QAClD,oBAAoB,GAAG,wBAAwB,CAAC,YAAY,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,yCAAyC;YAC/D,IAAI;YACJ,uEAAuE;YACvE,qEAAqE;YACrE,+DAA+D;YAC/D,wEAAwE;YACxE,2EAA2E;YAC3E,mDAAmD;YACnD,iEAAiE;YACjE,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,4CAA4C;YAC5C,IAAI;YACJ,qCAAqC,kBAAkB,MAAM;YAC7D,IAAI;YACJ,2EAA2E;YAC3E,uEAAuE;YACvE,IAAI;YACJ,kCAAkC;YAClC,wCAAwC,kBAA4B,MAAM;YAC1E,kFAAkF;YAClF,SAAS;YACT,kFAAkF;YAClF,+BAA+B;YAC/B,+CAA+C;YAC/C,4CAA4C;YAC5C,SAAS;YACT,OAAO;YACP,IAAI;YACJ,uEAAuE;YACvE,iEAAiE;YACjE,IAAI;YACJ,4EAA4E;YAC5E,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,iDAAiD;IACjD,2CAA2C;IAE3C,IAAI,mBAAmB,GAAgB,UAAU,CAAC;IAClD,IAAI,8BAA8B,GAAG,+BAA+B,CAAC;IACrE,IAAI,2BAA2B,GAAG,kBAAkB,CAAC;IAErD,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,oBAAoB,KAAK,oBAAoB,CAAC,SAAS,EAAE,CAAC;YAC5D,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,+DAA+D,oBAAoB,GAAG,CAC7G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,iEAAiE,CACxF,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAI,WAA4B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gEAAgE;oBACtF,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAAS,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa;gBAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,0FAA0F,CACjH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAW,CAAC,EAAE,CAAC;YAChE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,2FAA2F,CAClH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,qBAAqB,CAAC,WAAkB,CAAC,EAAE,CAAC;YACvE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,wGAAwG,CAC/H,CAAC;QACJ,CAAC;QAED,mBAAmB,GAAI,UAAkB,CAAC,MAAM,CAAC;YAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;SAChE,CAAgB,CAAC;QAElB,MAAM,qBAAqB,GAAG,2BAA2B,CACvD,gBAAgB,CAAC,eAA+B,EAChD,kBAAkB,EAClB,+BAA+B,CAAC,GAAG,EACnC,wBAAyB,CAAC,YAAY,EACtC;YACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;YACvE,eAAe,EAAE,iBAAiB;YAClC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;YACrE,MAAM,EAAE,wBAAyB,CAAC,iBAAiB,CAAC,MAAM;YAC1D,IAAI,EAAE,wBAAyB,CAAC,IAAI;YACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACjC,eAAe,EAAE,wBAAyB,CAAC,eAAe,EAAE,SAAS;gBACnE,CAAC,CAAC,EAAE,SAAS,EAAE,wBAAyB,CAAC,eAAe,CAAC,SAAS,EAAE;gBACpE,CAAC,CAAC,SAAS;SACd,CACF,CAAC;QACF,8BAA8B,GAAG,CAAC,GAAG,+BAA+B,EAAE,qBAAqB,CAAC,CAAC;QAE7F,yEAAyE;QACzE,EAAE;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,qEAAqE;QACrE,4EAA4E;QAC5E,0EAA0E;QAC1E,4BAA4B;QAC5B,EAAE;QACF,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,iEAAiE;QACjE,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,YAAY;QACZ,EAAE;QACF,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,0BAA0B;QAC1B,EAAE;QACF,qEAAqE;QACrE,2EAA2E;QAC3E,2EAA2E;QAC3E,mEAAmE;QACnE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,MAAM,CAAC,kBAAkB,EAAE,UAAU,KAAK,wBAAwB,CAAC,SAAS,EAAE,CAAC;YACjF,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,0EAA0E;gBAChG,kGAAkG;gBAClG,oGAAoG;gBACpG,wGAAwG;gBACxG,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,2BAA2B,GAAG;YAC5B,GAAG,kBAAkB;YACrB,UAAU,EAAE,wBAAwB,CAAC,OAAO;SAC7C,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,yEAAyE;IACzE,2CAA2C;IAC3C,EAAE;IACF,+EAA+E;IAC/E,0EAA0E;IAC1E,2EAA2E;IAC3E,gFAAgF;IAChF,6EAA6E;IAC7E,qFAAqF;IACrF,oDAAoD;IACpD,IAAI,eAAe,EAAE,IAAI,EAAE,CAAC;QAC1B,+FAA+F;QAC/F,2FAA2F;QAC3F,oFAAoF;QACpF,kGAAkG;QAClG,2FAA2F;QAC3F,KAAK,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,gDAAgD,EAAE,CAAC;YACrG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,iBAAwB,CAAC,EAAE,CAAC;gBACvD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,8BAA8B,iBAAiB,uBAAuB,GAAG,IAAI,CACpG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2FAA2F;QAC3F,4FAA4F;QAC5F,6FAA6F;QAC7F,6FAA6F;QAC7F,sEAAsE;QACtE,8FAA8F;QAC9F,yFAAyF;QACzF,iEAAiE;QACjE,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACtC,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uEAAuE;gBAC7F,yGAAyG,CAC1G,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QAC7D,KAAK,MAAM,aAAa,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,CAAU,EAAE,CAAC;YAC7E,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjC,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,yCAAyC,aAAa,oBAAoB;oBAChG,4GAA4G,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,2FAA2F;QAC3F,2CAA2C;QAC3C,EAAE;QACF,+FAA+F;QAC/F,6FAA6F;QAC7F,iGAAiG;QACjG,gGAAgG;QAChG,oEAAoE;QACpE,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,wFAAwF;QACxF,0EAA0E;QAC1E,8FAA8F;QAC9F,6FAA6F;QAC7F,yFAAyF;QACzF,8FAA8F;QAC9F,wFAAwF;QACxF,qFAAqF;QACrF,gGAAgG;QAChG,iGAAiG;QACjG,0FAA0F;QAC1F,8FAA8F;QAC9F,8FAA8F;QAC9F,gBAAgB;QAChB,+FAA+F;QAC/F,4FAA4F;QAC5F,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACrE,MAAM,SAAS,GAAG,yBAAyB,CAAC,WAA2B,CAAC,CAAC;YACzE,IAAI,SAAS,KAAK,SAAS;gBAAE,SAAS;YAEtC,4FAA4F;YAC5F,6FAA6F;YAC7F,IAAI,mCAAmC,CAAC,SAAS,CAAC;gBAAE,SAAS;YAE7D,iGAAiG;YACjG,iGAAiG;YACjG,gGAAgG;YAChG,4FAA4F;YAC5F,yDAAyD;YACzD,MAAM,YAAY,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAC;YAClE,IACE,SAAS,KAAK,aAAa,CAAC,MAAM;gBAClC,YAAY,KAAK,SAAS;gBAC1B,YAAY,KAAK,oBAAoB,EACrC,CAAC;gBACD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,YAAY,SAAS,4DAA4D;oBACvG,8BAA8B,YAAY,+DAA+D;oBACzG,wGAAwG;oBACxG,qFAAqF,CACtF,CAAC;YACJ,CAAC;YAED,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,+FAA+F;YAC/F,8FAA8F;YAC9F,8FAA8F;YAC9F,0FAA0F;YAC1F,gGAAgG;YAChG,0EAA0E;YAE1E,0FAA0F;YAC1F,6FAA6F;YAC7F,0FAA0F;YAC1F,4FAA4F;YAC5F,2FAA2F;YAC3F,uFAAuF;YACvF,IAAI,SAAS,KAAK,aAAa,CAAC,IAAI,IAAI,yBAAyB,CAAC,WAA2B,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC7G,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,YAAY,SAAS,6DAA6D;oBACxG,IAAI,SAAS,iGAAiG,CAC/G,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;gBACvC,yFAAyF;gBACzF,0FAA0F;gBAC1F,kFAAkF;gBAClF,mBAAmB;gBACnB,EAAE;gBACF,mFAAmF;gBACnF,2FAA2F;gBAC3F,wFAAwF;gBACxF,4FAA4F;gBAC5F,sFAAsF;gBACtF,UAAU;gBACV,IAAI,CAAC,0BAA0B,CAAC,WAA2B,CAAC,EAAE,CAAC;oBAC7D,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,YAAY,SAAS,8DAA8D;wBACzG,uGAAuG;wBACvG,oGAAoG;wBACpG,yEAAyE,CAC1E,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;gBAC5C,4FAA4F;gBAC5F,6FAA6F;gBAC7F,0FAA0F;gBAC1F,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,WAA2B,CAAC,CAAC;gBACtF,IAAI,CAAE,WAA4B,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE,CAAC;oBACzE,MAAM,wBAAwB,CAC5B,kBAAkB,KAAK,2BAA2B;wBAChD,CAAC,CAAC,IAAI,kBAAkB,YAAY,SAAS,0DAA0D;4BACrG,sCAAsC,2BAA2B,uCAAuC;4BACxG,uGAAuG;4BACvG,2EAA2E;4BAC3E,gGAAgG;wBAClG,CAAC,CAAC,IAAI,kBAAkB,YAAY,SAAS,+CAA+C;4BAC1F,cAAc,kBAAkB,gEAAgE;4BAChG,8FAA8F;4BAC9F,6CAA6C,CAClD,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,KAAK,aAAa,CAAC,KAAK,EAAE,CAAC;gBAC7C;;;;;;;;;;;;;mBAaG;gBACH,IAAI,CAAC;oBACH,8BAA8B,CAAC,WAA2B,EAAE,SAAS,CAAC,CAAC;gBACzE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kGAAkG;QAClG,gGAAgG;QAChG,kGAAkG;QAClG,gGAAgG;QAChG,sGAAsG;QACtG,gGAAgG;QAChG,oGAAoG;QACpG,iFAAiF;QACjF,0FAA0F;QAC1F,oGAAoG;QACpG,+FAA+F;QAC/F,qGAAqG;QACrG,sGAAsG;QACtG,oCAAoC,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;QAE9E,+FAA+F;QAC/F,+FAA+F;QAC/F,mDAAmD;QACnD,MAAM,mBAAmB,GAAG,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;QAC9E,IAAI,eAAe,CAAC,IAAI,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;YAC9D,iGAAiG;YACjG,gGAAgG;YAChG,4EAA4E;YAC5E,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uFAAuF;oBAC7G,0BAA0B,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;oBAC7G,+GAA+G,CAChH,CAAC;YACJ,CAAC;YACD;;;;;;;;;;;;;eAaG;YACH,MAAM,0BAA0B,GAAG,iCAAiC,CAAC,mBAAmB,CAAC,CAAC;YAC1F,IAAI,0BAA0B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uFAAuF;oBAC7G,0BAA0B,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C;oBAC3G,6GAA6G;oBAC7G,qGAAqG;oBACrG,2GAA2G,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,mFAAmF;gBACzG,2GAA2G;gBAC3G,iGAAiG;gBACjG,0GAA0G;gBAC1G,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,gFAAgF;QAChF,iFAAiF;QACjF,+EAA+E;QAC/E,gFAAgF;QAChF,mBAAmB,GAAI,mBAA2B,CAAC,MAAM,CAAC;YACxD,eAAe,EAAE,qBAAqB;iBACnC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC/B,WAAW,EAAE;iBACb,iBAAiB,EAAE;iBACnB,iBAAiB,EAAE;iBACnB,QAAQ,EAAE;YACb,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE;iBACvB,QAAQ,EAAE;iBACV,WAAW,EAAE;iBACb,iBAAiB,EAAE;iBACnB,iBAAiB,EAAE;iBACnB,QAAQ,EAAE;SACd,CAAgB,CAAC;QAElB,qEAAqE;QACrE,gFAAgF;QAChF,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,kFAAkF;QAClF,0EAA0E;QAC1E,iFAAiF;QACjF,IAAI,MAAM,CAAC,kBAAkB,EAAE,UAAU,KAAK,wBAAwB,CAAC,SAAS,EAAE,CAAC;YACjF,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,qEAAqE;gBAC3F,kGAAkG;gBAClG,yGAAyG,CAC1G,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,kBAAkB,EAAE,WAAW,KAAK,wBAAwB,CAAC,SAAS,EAAE,CAAC;YAClF,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,sEAAsE;gBAC5F,yFAAyF;gBACzF,iGAAiG,CAClG,CAAC;QACJ,CAAC;QACD,2BAA2B,GAAG;YAC5B,GAAG,2BAA2B;YAC9B,UAAU,EAAE,wBAAwB,CAAC,OAAO;YAC5C,WAAW,EAAE,wBAAwB,CAAC,OAAO;SAC9C,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,iGAAiG;IACjG,qDAAqD;IACrD,EAAE;IACF,6FAA6F;IAC7F,mGAAmG;IACnG,kGAAkG;IAClG,oBAAoB;IACpB,EAAE;IACF,kFAAkF;IAClF,yFAAyF;IACzF,6FAA6F;IAC7F,iGAAiG;IACjG,qGAAqG;IACrG,IAAI,eAAe,EAAE,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uEAAuE;YAC7F,6FAA6F;YAC7F,+FAA+F;YAC/F,0FAA0F;YAC1F,8FAA8F;YAC9F,2FAA2F;YAC3F,6FAA6F;YAC7F,8FAA8F;YAC9F,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;QAChD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,0EAA0E;YAChG,sFAAsF;YACtF,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,KAAK,uBAAuB,CAAC,gBAAgB,CAAC;QAChG,IAAI,mBAAmB,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,CAAC;YACpE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uDAAuD;gBAC7E,8FAA8F;gBAC9F,iGAAiG,CAClG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,mBAAmB,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,CAAC;YACpE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gEAAgE;gBACtF,iCAAiC,iBAAiB,CAAC,IAAI,yCAAyC;gBAChG,yFAAyF;gBACzF,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,iGAAiG;QACjG,iGAAiG;QACjG,iGAAiG;QACjG,mGAAmG;QACnG,gGAAgG;QAChG,iEAAiE;QACjE,EAAE;QACF,gGAAgG;QAChG,kGAAkG;QAClG,4BAA4B;QAC5B,IAAI,mBAAmB,IAAI,UAAU,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;YAC7D,MAAM,cAAc,GAAG,iBAAiB,CAAC,qBAA+B,CAAC;YACzE,IAAI,CAAC,CAAC,cAAc,IAAK,UAAU,CAAC,KAAiC,CAAC,EAAE,CAAC;gBACvE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gDAAgD,cAAc,WAAW;oBAC/F,kDAAkD,CACnD,CAAC;YACJ,CAAC;YACD,IAAI,cAAc,IAAI,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/D,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gDAAgD,cAAc,OAAO;oBAC3F,+FAA+F;oBAC/F,8FAA8F;oBAC9F,8FAA8F;oBAC9F,4FAA4F,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,EAAE;QACF,oFAAoF;QACpF,kGAAkG;QAClG,kGAAkG;QAClG,8FAA8F;QAC9F,iGAAiG;QACjG,kFAAkF;QAClF,EAAE;QACF,iGAAiG;QACjG,iFAAiF;QACjF,EAAE;QACF,iGAAiG;QACjG,8FAA8F;QAC9F,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,MAAM,CAAC,kBAAkB,EAAE,IAAI,KAAK,wBAAwB,CAAC,SAAS,EAAE,CAAC;gBAC3E,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uDAAuD;oBAC7E,+FAA+F;oBAC/F,6FAA6F;oBAC7F,uEAAuE,CACxE,CAAC;YACJ,CAAC;YACD,2BAA2B,GAAG;gBAC5B,GAAG,2BAA2B;gBAC9B,IAAI,EAAE,wBAAwB,CAAC,OAAO;aACvC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,sCAAsC;IACtC,2CAA2C;IAC3C,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,0FAA0F;IAC1F,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,0BAA0B;IAC1B,EAAE;IACF,gGAAgG;IAChG,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,wEAAwE;IACxE,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,kGAAkG;IAClG,0BAA0B;IAC1B,IAAI,WAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC9F,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAA2B,CAAC,CAAC;YAChE,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,YAAY,SAAS,0BAA0B,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;oBACpH,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,sCAAsC;oBAC7H,8FAA8F;oBAC9F,qGAAqG;oBACrG,iGAAiG,CAClG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,mCAAmC;IACnC,2CAA2C;IAE3C,MAAM,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,GAAG,8BAA8B,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAC;IAE5J,2CAA2C;IAC3C,uDAAuD;IACvD,2CAA2C;IAE3C,uFAAuF;IACvF,sDAAsD;IACtD,wEAAwE;IACxE,MAAM,oBAAoB,GAAG,2BAA2B;QACtD,CAAC,CAAC,qBAAqB,CAAC,wCAAwC,CAC5D,mBAA4D,EAC5D,2BAA4H,CAC7H;QACH,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;IAEnE,2CAA2C;IAC3C,mDAAmD;IACnD,2CAA2C;IAE3C,MAAM,UAAU,GAA6F,EAAE,CAAC;IAEhH,iDAAiD;IACjD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IAC/C,MAAM,gBAAgB,GAAG,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC;IACjD,MAAM,gBAAgB,GAAG,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC;IACjD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,eAAe;IACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,eAAe;IACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,eAAe;IACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,eAAe;IAEnF,mCAAmC;IACnC,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAqI,EAAE,CAAC;QAC9M,6BAA6B,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE5F,qEAAqE;QACrE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAyG,CAAC;QAExI,+BAA+B;QAC/B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAChC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7C,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC9C,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,KAAK,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YACpE,IAAI,CAAC,+BAA+B,CAAC,WAAW,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9E,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,KAAK,IAAI,CAC3B,CAAC;gBACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,wBAAwB,CAAC,cAAc,SAAS,mBAAmB,WAAW,sDAAsD,CAAC,CAAC;gBAC9I,CAAC;gBACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,wBAAwB,CAAC,cAAc,SAAS,mBAAmB,WAAW,4DAA4D,CAAC,CAAC;gBACpJ,CAAC;YACH,CAAC;YAED,IAAI,+BAA+B,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjD,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;oBACpC,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,yEAAyE;oBACzE,2EAA2E;oBAC3E,qEAAqE;oBACrE,6EAA6E;oBAC7E,8EAA8E;oBAC9E,6EAA6E;oBAC7E,2DAA2D;oBAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACjD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,wBAAwB,WAAW,uCAAuC;4BACjG,kGAAkG;4BAClG,yFAAyF;4BACzF,oGAAoG;4BACpG,4EAA4E,CAC7E,CAAC;oBACJ,CAAC;oBACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;wBACvB,6BAA6B,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;oBACrF,CAAC;oBACD,IAAI,OAAO,CAAC,UAAU,IAAI,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;wBAChG,MAAM,wBAAwB,CAC5B,cAAc,SAAS,qCAAqC,OAAO,CAAC,UAAU,GAAG,CAClF,CAAC;oBACJ,CAAC;oBACD,IAAI,OAAO,CAAC,UAAU,IAAI,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAiF,CAAC;2BACrK,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,EAC1D,CAAC;wBACD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,8CAA8C,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,mCAAmC,CACzI,CAAC;oBACJ,CAAC;oBACD,IAAI,OAAO,CAAC,UAAU,IAAI,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAiF,CAAC;2BACrK,CAAC,uCAAuC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,EACvE,CAAC;wBACD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,sCAAsC,OAAO,CAAC,UAAU,2CAA2C,CAC3H,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,+BAA+B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACpH,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;QACpG,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,yBAAyB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3C,MAAM,wBAAwB,CAC5B,cAAc,SAAS,gFAAgF,CACxG,CAAC;YACJ,CAAC;YACD,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,wBAAwB,CAC5B,cAAc,SAAS,uGAAuG,CAC/H,CAAC;YACJ,CAAC;QACH,CAAC;QACD,mFAAmF;QACnF,uFAAuF;QACvF,wFAAwF;QACxF,yFAAyF;QACzF,kFAAkF;QAClF,kFAAkF;QAClF,6EAA6E;QAC7E,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,MAAM,KAAK,CAAC;YAC7D,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC;YACpE,CAAC,CAAC,yBAAyB,CAAC;QAE9B,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/C,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,MAAM,aAAa,GAAG,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAEjE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,MAAM,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAC9D,IAAI,oBAAoB,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBACnD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,8BAA8B,OAAO,CAAC,UAAU,+BAA+B,CACvG,CAAC;gBACJ,CAAC;gBACD,oBAAoB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACxB,MAAM,wBAAwB,CAC5B,cAAc,SAAS,yEAAyE,CACjG,CAAC;YACJ,CAAC;QAEH,CAAC;QAEC,6EAA6E;QAC7E,MAAM,8BAA8B,GAAG,iDAAiD,CACtF,8BAA8B,EAC9B,4BAA4B,EAC5B,MAAM,CAAC,0CAA0C,IAAI,EAAE,EACvD,SAAmB,CACpB,CAAC;QAEF,mDAAmD;QACnD,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,MAAM,CAAC,iBAAiB,IAAI,EAAE,EAC9B,kBAAkB,EAClB,SAAS,EACT,oBAAoB,CACrB,CAAC;QAEF,iDAAiD;QACjD,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAC7B,kBAAkB,EAClB,SAAS,CACV,CAAC;QAEJ,sDAAsD;QACtD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE;YACtD,sGAAsG;YACtG,iDAAiD;YAEjD,kEAAkE;YAClE,wEAAwE;YACxE,mEAAmE;YACnE,MAAM,kBAAkB,GAAG,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC/E,MAAM,kBAAkB,GAAG,+BAA+B,CAAC,aAAa,CAAC,WAAW,CAAC;gBACnF,CAAC,CAAC,gCAAgC,CAAC,iBAAiB,EAAE,aAAa,CAAC;gBACpE,CAAC,CAAC,gCAAgC,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;YAExE,mDAAmD;YACnD,kFAAkF;YAClF,MAAM,iBAAiB,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAgB,CAAC,CAAC;YACrE,MAAM,wBAAwB,GAAG,iBAAiB;gBAChD,CAAC,CAAC,CAAC,aAAa,CAAC,qBAAqB,IAAI,SAAS,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;YAEd,2EAA2E;YAC3E,mEAAmE;YACnE,yEAAyE;YACzE,2EAA2E;YAC3E,wEAAwE;YACxE,qEAAqE;YACrE,qDAAqD;YACrD,4EAA4E;YAC5E,4EAA4E;YAC5E,wEAAwE;YACxE,kDAAkD;YAClD,EAAE;YACF,sEAAsE;YACtE,4EAA4E;YAC5E,4EAA4E;YAC5E,uEAAuE;YACvE,2EAA2E;YAC3E,2EAA2E;YAC3E,IAAI,iBAAiB,IAAI,CAAE,aAAiD,CAAC,iBAAiB;mBACzF,CACD,aAAa,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,MAAM;uBACjE,aAAa,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,WAAW;uBACzE,aAAa,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,KAAK,CACvE,EACD,CAAC;gBACD,OAAO,CAAC,IAAI,CACV,6CAA6C,MAAM,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI;sBAC9F,WAAW,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,6CAA6C;sBACnG,+FAA+F;sBAC/F,gGAAgG;sBAChG,yEAAyE,CAC5E,CAAC;YACJ,CAAC;YAED,oEAAoE;YACpE,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,wBAAkC,EAClC,mBAAmB,EACnB,aAAa,CAAC,UAAU,CACzB,CAAC;YAEF,kDAAkD;YAClD,gEAAgE;YAChE,8DAA8D;YAC9D,4DAA4D;YAC5D,4CAA4C;YAC5C,MAAM,iBAAiB,GAAG,GAAiB,EAAE;gBAC3C,IAAK,aAAqB,CAAC,iBAAiB,EAAE,CAAC;oBAC7C,OAAQ,aAAqB,CAAC,iBAAiB,CAAC;gBAClD,CAAC;gBACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI;uBACtC,aAAqB,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,IAAI,EAAE,CAAC;oBACjF,OAAO,oBAAoB,CAAC;gBAC9B,CAAC;gBACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,MAAM;uBACxC,aAAqB,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,MAAM,EAAE,CAAC;oBACnF,OAAO,oBAAoB,CAAC;gBAC9B,CAAC;gBACD,OAAO,mBAAmB,CAAC;YAC7B,CAAC,CAAC;YAEF,mGAAmG;YACnG,MAAM,oBAAoB,GAAG,iBAAiB,EAAE,CAAC;YAEjD,6DAA6D;YAC7D,2FAA2F;YAC3F,oFAAoF;YACpF,gFAAgF;YAChF,MAAM,mBAAmB,GAAG;gBAC1B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,mBAAmB;gBAC/B,oBAAoB;gBACpB,kBAAkB;gBAClB,uBAAuB;gBACvB,qBAAqB,EAAE,8BAA8B;gBACrD,gBAAgB;gBAChB,mBAAmB,EAAE,SAAS;gBAC9B,kBAAkB;gBAClB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,oCAAoC,CAAC,MAAM;gBAC5F,UAAU,EAAE,iBAAiB,EAAE,wDAAwD;gBACvF,WAAW,EAAE,oBAAoB,EAAE,wDAAwD;gBAC3F,4EAA4E;gBAC5E,iFAAiF;gBACjF,8EAA8E;gBAC9E,iFAAiF;gBACjF,gFAAgF;gBAChF,mBAAmB,EAAE,CAAC,CAAE,aAAqB,CAAC,UAAU;gBACxD,oBAAoB,EAAE,CAAC,CAAE,aAAqB,CAAC,iBAAiB;gBAChE,2BAA2B,EAAE,MAAM,CAAC,2BAA2B,IAAI,EAAE;gBACrE,iBAAiB;gBACjB,gBAAgB;gBAChB,qFAAqF;gBACrF,yFAAyF;gBACzF,2EAA2E;gBAC3E,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,0DAA0D;gBAC1D,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;gBAC1D,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,sFAAsF;gBACtF,0FAA0F;gBAC1F,wFAAwF;gBACxF,uFAAuF;gBACvF,gBAAgB,EAAG,aAAqB,CAAC,gBAAgB;gBACzD,gBAAgB,EAAE,yBAAyB,CAAC,aAAa,CAAC,gBAAgB,CAAC;gBAC3E,SAAS,EAAE,aAAa,CAAC,SAAS,IAAI,0BAA0B,CAAC,GAAG;gBACpE,2FAA2F;gBAC3F,yFAAyF;gBACzF,2EAA2E;gBAC3E,sBAAsB,EAAE,aAAa,CAAC,sBAAsB;gBAC5D,KAAK,EAAE,aAAa,CAAC,KAAK;gBAC1B,wFAAwF;gBACxF,sFAAsF;gBACtF,kFAAkF;gBAClF,yBAAyB;gBACzB,4BAA4B,EAAE,aAAa,CAAC,4BAA4B;gBACxE,4FAA4F;gBAC5F,2FAA2F;gBAC3F,2CAA2C;gBAC3C,4BAA4B,EAAE,aAAa,CAAC,4BAA4B;gBACxE,uCAAuC,EAAE,aAAa,CAAC,uCAAuC;gBAC9F,4FAA4F;gBAC5F,oFAAoF;gBACpF,oCAAoC,EAAE,aAAa,CAAC,oCAAoC;gBACxF,uFAAuF;gBACvF,4FAA4F;gBAC5F,8FAA8F;gBAC9F,cAAc,EAAE,aAAa,CAAC,cAAc;gBAC5C,GAAG,EAAE,aAAa,CAAC,GAAG;gBACtB,gCAAgC,EAAE,aAAa,CAAC,gCAAgC,IAAI,EAAE;gBACtF,oBAAoB,EAAE,aAAa,CAAC,oBAAoB;gBACxD,4FAA4F;gBAC5F,2FAA2F;gBAC3F,4EAA4E;gBAC5E,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;gBACtD,2FAA2F;gBAC3F,0FAA0F;gBAC1F,4FAA4F;gBAC5F,6FAA6F;gBAC7F,0FAA0F;gBAC1F,+CAA+C;gBAC/C,oBAAoB,EAAE,aAAa,CAAC,oBAAoB;aACzD,CAAC;YAIF,IAAI,+BAA+B,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/D,MAAM,aAAa,GAAG,aAErB,CAAC;gBACF,MAAM,iBAAiB,GAAG,aAAa,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CAAC;gBAC5G,MAAM,cAAc,GAAG,aAItB,CAAC;gBAEF,yEAAyE;gBACzE,MAAM,iBAAiB,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAgB,CAAC,CAAC;gBACrE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;gBAE7F,gFAAgF;gBAChF,MAAM,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,IAAI,KAAK,CAAC;gBACnE,IAAI,iBAAiB,IAAI,CAAC,gBAAgB,KAAK,qBAAqB,CAAC,IAAI,IAAI,gBAAgB,KAAK,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9H,MAAM,wBAAwB,CAAC,cAAc,SAAS,gEAAgE,CAAC,CAAC;gBAC1H,CAAC;gBACD,MAAM,qBAAqB,GAAG;oBAC5B,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC;gBACF,IACE,qBAAqB,CAAC,MAAM,GAAG,CAAC;uBAC7B,CACD,iBAAiB;2BACd,sCAAsC,CAAC,gBAAgB,CAAC,CAC5D,EACD,CAAC;oBACD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,0DAA0D,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;0BACpH,gHAAgH;0BAChH,gHAAgH;0BAChH,kDAAkD,CACvD,CAAC;gBACJ,CAAC;gBACD,IAAI,aAAa,CAAC,eAAe,IAAI,gBAAgB,KAAK,qBAAqB,CAAC,MAAM,EACpF,CAAC;oBACD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,6FAA6F;0BAChH,4EAA4E,CACjF,CAAC;gBACJ,CAAC;gBAED,yEAAyE;gBACzE,IAAI,QAAoB,CAAC;gBACzB,IAAI,iBAAiB,EAAE,CAAC;oBACtB,qFAAqF;oBACrF,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC;wBACzC,MAAM,wBAAwB,CAAC,cAAc,SAAS,gEAAgE,CAAC,CAAC;oBAC1H,CAAC;oBACD,QAAQ,GAAG,8BAA8B,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;gBACjF,CAAC;qBAAM,CAAC;oBACN,gDAAgD;oBAChD,QAAQ,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;gBACvD,CAAC;gBAID,gDAAgD;gBAChD,IAAI,aAAa,CAAC,eAAe,EAAE,CAAC;oBAClC,6BAA6B,CAC3B,aAAa,CAAC,eAAe,EAC7B,kBAA4B,EAC5B,SAAmB,CACpB,CAAC;gBACJ,CAAC;gBACD,IAAI,aAAa,CAAC,eAAe,EAAE,CAAC;oBAClC,6BAA6B,CAC3B,aAAa,CAAC,eAAe,EAC7B,kBAA4B,EAC5B,SAAmB,CACpB,CAAC;gBACJ,CAAC;gBAED,MAAM,sBAAsB,GAAG;oBAC7B,GAAG,mBAAmB;oBACtB,QAAQ;oBACR,sBAAsB,EAAE,aAAa,CAAC,sBAAsB,IAAI,KAAK;oBACrE,eAAe,EAAE,KAAK,EAAE,mBAAmB;oBAC3C,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;oBACtD,eAAe,EAAE,aAAa,CAAC,eAAe;oBAC9C,eAAe,EAAE,aAAa,CAAC,eAAe;oBAC9C,qDAAqD;oBACrD,+DAA+D;oBAC/D,oEAAoE;oBACpE,oEAAoE;oBACpE,4BAA4B;oBAC5B,SAAS,EAAE,aAAa,CAAC,SAAS;oBAClC,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;oBAChD,SAAS,EAAE,aAAa,CAAC,SAAS;oBAClC,UAAU,EAAE,aAAa,CAAC,UAAU;oBACpC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;wBACtB,WAAW,EAAE,cAAc,CAAC,WAAW;wBACvC,eAAe,EAAE,cAAc,CAAC,eAAe,IAAI,GAAG;wBACtD,qBAAqB,EAAE,cAAc,CAAC,qBAAqB,IAAI,CAAC;qBACjE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;gBAEF,mEAAmE;gBACnE,wFAAwF;gBACxF,sFAAsF;gBACtF,MAAM,YAAY,GAAG,SAAS,KAAK,qBAAqB,CAAC,MAAM;uBACzD,aAAqB,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,MAAM,CAAC;gBACnF,MAAM,UAAU,GAAG,SAAS,KAAK,qBAAqB,CAAC,IAAI;uBACrD,aAAqB,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,IAAI,CAAC;gBAEjF,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,QAAQ,GAAI,aAAqB,CAAC,QAAQ,IAAI,EAAE,CAAC;oBACvD,MAAM,YAAY,GAAI,aAAqB,CAAC,YAAY,KAAK,KAAK,CAAC;oBACnE,MAAM,gBAAgB,GAAI,aAAqB,CAAC,gBAAgB,IAAI,EAAE,CAAC;oBACvE,MAAM,iBAAiB,GAAI,aAAqB,CAAC,iBAAiB,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;oBACrH,MAAM,eAAe,GAAI,aAAqB,CAAC,YAAY,IAAI,EAAE,CAAC;oBAClE,MAAM,UAAU,GAAI,aAAqB,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC3D,MAAM,8BAA8B,GAAI,aAAqB,CAAC,8BAA8B,IAAI,EAAE,CAAC;oBAEnG,MAAM,YAAY,GAAqC,EAAE,CAAC;oBAC1D,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;wBACvD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;4BAChC,YAAY,CAAC,GAAG,CAAC,GAAG,KAAyB,CAAC;wBAChD,CAAC;oBACH,CAAC,CAAC,CAAC;oBAEH,MAAM,wBAAwB,GAAG,sCAAsC,CAAC;wBACtE,YAAY;wBACZ,iBAAiB,EAAE,UAAU;wBAC7B,UAAU,EAAE,IAAI;wBAChB,sFAAsF;wBACtF,8DAA8D;wBAC9D,8BAA8B;qBAC/B,CAAC,CAAC;oBAEH,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;wBACpE,UAAU,EAAE,oBAAoB;wBAChC,wBAAwB,EAAE,IAAI;wBAC9B,sBAAsB,EAAE,8BAA8B;qBACvD,CAAC,CAAC;oBAEH,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE;wBACpC,QAAQ;wBACR,YAAY;wBACZ,gBAAgB;wBAChB,iBAAiB;wBACjB,YAAY,EAAE,eAAe;wBAC7B,UAAU;wBACV,8BAA8B;wBAC9B,wBAAwB;wBACxB,WAAW,EAAE,uBAAuB;wBACpC,oBAAoB,EAAE,KAAK;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,cAAc,GAA4B;wBAC9C,QAAQ,EAAG,aAAqB,CAAC,QAAQ,IAAI,EAAE;wBAC/C,aAAa,EAAG,aAAqB,CAAC,aAAa,IAAI,IAAI;wBAC3D,cAAc,EAAG,aAAqB,CAAC,cAAc,IAAI,IAAI;wBAC7D,gFAAgF;wBAChF,+EAA+E;wBAC/E,oFAAoF;wBACpF,8BAA8B,EAAG,aAAqB,CAAC,8BAA8B,IAAI,GAAG;qBAC7F,CAAC;oBACF,IAAK,aAAqB,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;wBACtD,cAAc,CAAC,YAAY,GAAI,aAAqB,CAAC,YAAY,CAAC;oBACpE,CAAC;oBACD,IAAK,aAAqB,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;wBACpD,cAAc,CAAC,UAAU,GAAI,aAAqB,CAAC,UAAU,CAAC;oBAChE,CAAC;oBACD,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAC;gBACxD,CAAC;gBACD,mEAAmE;gBAEnE,uBAAuB;gBACvB,UAAU,CAAC,IAAI,CAAC,sBAAgH,CAAC,CAAC;gBAElI,gCAAgC;gBAChC,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;wBACpB,IAAI,gBAAgB,KAAK,qBAAqB,CAAC,MAAM,EAAE,CAAC;4BACtD,OAAO,sBAAsB,CAAC,UAAU,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gCAC5F,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;oCACP,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,UAAU,CAAC;iCACjD,CAAC;gCACJ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;oCACP,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;iCAC5B,CAAC,CAAC;wBACT,CAAC;wBAED,IAAI,sBAAsB,CAAC,UAAU,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;4BAC7D,OAAO,iCAAiC,CAAC,MAAM,CAC7C,iBAAiB,CAAC,sBAAsB,CAAC,UAAU,CAAC,CACrD,CAAC;wBACJ,CAAC;wBAED,OAAO,sBAAsB,CAAC,UAAU,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;4BAC5F,CAAC,CAAC,iCAAiC,CAAC,GAAG,CAAC,sBAAsB,CAAC,UAAU,CAAC;4BAC1E,CAAC,CAAC,iCAAiC,CAAC;oBACxC,CAAC,CAAC,EAAE,CAAC;oBAEL,MAAM,mBAAmB,GAAG;wBAC1B,GAAG,sBAAsB;wBACzB,eAAe,EAAE,IAAI;wBACrB,kBAAkB,EAAE,KAAK,EAAE,oCAAoC;wBAC/D,UAAU,EAAE,OAAO;qBACpB,CAAC;oBAEF,UAAU,CAAC,IAAI,CAAC,mBAA6G,CAAC,CAAC;gBACjI,CAAC;YAEH,CAAC;iBAAM,CAAC;gBACN,+EAA+E;gBAC/E,MAAM,EAAE,WAAW,EAAE,GAAG,cAAc,EAAE,GAAG,aAAa,CAAC,CAAC,mCAAmC;gBAE7F,MAAM,mBAAmB,GAAG;oBAC1B,GAAG,mBAAmB;oBACtB,GAAG,cAAc;iBAClB,CAAC;gBAEF,UAAU,CAAC,IAAI,CAAC,mBAA6G,CAAC,CAAC;YACjI,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,2CAA2C;QAC3C,0CAA0C;QAC1C,2CAA2C;QAE3C,+DAA+D;QAC/D,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,EAAE,CAAC;YACzF,sFAAsF;YACtF,gEAAgE;YAChE,MAAM,qBAAqB,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAC1E,SAAS,CAAC,mBAAmB,KAAK,SAAS;mBACxC,+BAA+B,CAAC,SAAS,CAAC,WAAW,CAAC;mBACtD,SAAS,CAAC,kBAAkB,KAAK,IAAI;mBACrC,CAAC,CAAC,iBAAiB,IAAI,SAAS,IAAI,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,CAC3E,CAMY,CAAC;YAEd,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC3B,kDAAkD;gBAClD,SAAS;YACX,CAAC;YAED,MAAM,2BAA2B,GAAG,qBAAiF,CAAC;YAEtH,qCAAqC;YACrC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAC7B,SAAS,CAAC,mBAAmB,KAAK,SAAS;mBACxC,+BAA+B,CAAC,SAAS,CAAC,WAAW,CAAC;mBACtD,SAAS,CAAC,UAAU;mBACpB,CAAC,CAAC,iBAAiB,IAAI,SAAS,IAAI,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,CAC3E,CAAC;iBACD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAW,CAAC,WAAW,EAAE,CAAC,CAC3D,CAAC;YAEF,0CAA0C;YAC1C,+FAA+F;YAC/F,gFAAgF;YAChF,MAAM,0BAA0B,GAAG,CACjC,UAAuF,EACvF,WAAyB,EACzB,SAAkB,EACsE,EAAE;gBAC1F,MAAM,mBAAmB,GAAG;oBAC1B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;oBACtC,UAAU,EAAE,mBAAmB;oBAC/B,oBAAoB;oBACpB,kBAAkB;oBAClB,uBAAuB;oBACvB,qBAAqB,EAAE,8BAA8B;oBACrD,gBAAgB;oBAChB,mBAAmB,EAAE,SAAS;oBAC9B,kBAAkB,EAAE,KAAK,EAAE,4CAA4C;oBACvE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,oCAAoC,CAAC,MAAM;oBAC5F,UAAU,EAAE,qBAAqB,CAAC,UAAU,IAAI,gBAAgB,CAAC,SAAmB,EAAE,mBAAmB,EAAE,SAAS,CAAC,EAAE,wDAAwD;oBAC/K,yFAAyF;oBACzF,yFAAyF;oBACzF,iFAAiF;oBACjF,6EAA6E;oBAC7E,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB,IAAI,CAAC,CAAC,qBAAqB,CAAC,UAAU;oBACpG,WAAW,EAAE,wDAAwD;oBACrE,2BAA2B,EAAE,MAAM,CAAC,2BAA2B,IAAI,EAAE;oBACrE,iBAAiB;oBACjB,gBAAgB;oBAChB,WAAW,EAAE,qBAAqB,CAAC,WAAW;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,qBAAqB;oBAClE,gBAAgB,EAAE,yBAAyB,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;oBACnF,SAAS,EAAE,qBAAqB,CAAC,SAAS,IAAI,0BAA0B,CAAC,GAAG;oBAC5E,wFAAwF;oBACxF,uFAAuF;oBACvF,0EAA0E;oBAC1E,sBAAsB,EAAE,qBAAqB,CAAC,sBAAsB;oBACpE,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,qCAAqC;oBACzE,iFAAiF;oBACjF,iFAAiF;oBACjF,6EAA6E;oBAC7E,4BAA4B,EAAE,qBAAqB,CAAC,4BAA4B;oBAChF,yFAAyF;oBACzF,sFAAsF;oBACtF,wFAAwF;oBACxF,0FAA0F;oBAC1F,uBAAuB;oBACvB,4BAA4B,EAAE,qBAAqB,CAAC,4BAA4B;oBAChF,uCAAuC,EAAE,qBAAqB,CAAC,uCAAuC;oBACtG,6FAA6F;oBAC7F,6FAA6F;oBAC7F,gEAAgE;oBAChE,oCAAoC,EAAE,qBAAqB,CAAC,oCAAoC;oBAChG,yFAAyF;oBACzF,2FAA2F;oBAC3F,wFAAwF;oBACxF,2FAA2F;oBAC3F,cAAc,EAAE,qBAAqB,CAAC,cAAc;oBACpD,GAAG,EAAE,qBAAqB,CAAC,GAAG,EAAE,gGAAgG;oBAChI,gCAAgC,EAAE,qBAAqB,CAAC,gCAAgC,IAAI,EAAE;oBAC9F,oBAAoB,EAAE,qBAAqB,CAAC,oBAAoB;oBAChE,wFAAwF;oBACxF,4EAA4E;oBAC5E,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;oBAC9D,2FAA2F;oBAC3F,6FAA6F;oBAC7F,yFAAyF;oBACzF,qFAAqF;oBACrF,oBAAoB,EAAE,qBAAqB,CAAC,oBAAoB;oBAChE,QAAQ,EAAE,qBAAqB,CAAC,QAAQ;oBACxC,sBAAsB,EAAE,qBAAqB,CAAC,sBAAsB,IAAI,KAAK;oBAC7E,eAAe,EAAE,KAAK;oBACtB,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;oBAC9D,eAAe,EAAE,qBAAqB,CAAC,eAAe;oBACtD,eAAe,EAAE,qBAAqB,CAAC,eAAe;oBACtD,8DAA8D;oBAC9D,gEAAgE;oBAChE,mEAAmE;oBACnE,iEAAiE;oBACjE,wEAAwE;oBACxE,SAAS,EAAE,qBAAqB,CAAC,SAAS;oBAC1C,gBAAgB,EAAE,qBAAqB,CAAC,gBAAgB;oBACxD,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,UAAU;oBACtB,GAAG,CAAC,SAAS,KAAK,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;wBAC7C,uFAAuF;wBACvF,yFAAyF;wBACzF,uFAAuF;wBACvF,sDAAsD;wBACtD,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;wBAC9C,aAAa,EAAE,2BAA2B,CAAC,aAAa;wBACxD,cAAc,EAAE,2BAA2B,CAAC,cAAc;wBAC1D,YAAY,EAAE,2BAA2B,CAAC,YAAY;wBACtD,UAAU,EAAE,2BAA2B,CAAC,UAAU;wBAClD,8BAA8B,EAAE,2BAA2B,CAAC,8BAA8B;qBAC3F,CAAC,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,qBAAqB,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CAAC,CAAC,CAAC;wBAC9F,WAAW,EAAE,qBAAqB,CAAC,WAAW;wBAC9C,eAAe,EAAE,qBAAqB,CAAC,eAAe;wBACtD,qBAAqB,EAAE,qBAAqB,CAAC,qBAAqB;qBACnE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;gBAEF,6DAA6D;gBAC7D,IAAI,qBAAqB,CAAC,eAAe,EAAE,CAAC;oBAC1C,6BAA6B,CAC3B,qBAAqB,CAAC,eAAe,EACrC,kBAA4B,EAC5B,GAAG,SAAmB,IAAI,UAAU,EAAE,CACvC,CAAC;gBACJ,CAAC;gBACD,IAAI,qBAAqB,CAAC,eAAe,EAAE,CAAC;oBAC1C,6BAA6B,CAC3B,qBAAqB,CAAC,eAAe,EACrC,kBAA4B,EAC5B,GAAG,SAAmB,IAAI,UAAU,EAAE,CACvC,CAAC;gBACJ,CAAC;gBAED,OAAO,mBAA6G,CAAC;YACvH,CAAC,CAAC;YAEF,gCAAgC;YAChC,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,IAAI,iBAAiB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7H,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;gBAChD,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;YACxG,CAAC;YAED,gCAAgC;YAChC,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,IAAI,iBAAiB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7H,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,CAAC,0BAA0B;gBAC1E,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;YACxG,CAAC;YAED,gCAAgC;YAChC,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,IAAI,iBAAiB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7H,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;oBAC/D,UAAU,EAAE,oBAAoB;oBAChC,wBAAwB,EAAE,IAAI;oBAC9B,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;iBACnF,CAAC,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;YACxG,CAAC;YAED,gCAAgC;YAChC,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,IAAI,iBAAiB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7H,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;oBAC/D,UAAU,EAAE,mBAAmB;oBAC/B,wBAAwB,EAAE,IAAI;oBAC9B,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;iBACnF,CAAC,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;YACxG,CAAC;QACH,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,wCAAwC;IACxC,2CAA2C;IAE3C,6GAA6G;IAC7G,6FAA6F;IAC7F,oEAAoE;IACpE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC/E,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE7C,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,iBAAiB,IAAI,EAAE,IAAI,EAAE,CAAC,eAAe,EAAE,oBAAoB,IAAI,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC;YACxG,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,SAAmB,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,qBAAqB,IAAI,EAAE,IAAI,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,yBAAyB,CAAC,QAAQ,EAAE,CAAC;YACzG,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;gBAC7C,kBAAkB,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACzD,IAAI,SAAS,KAAK,UAAU,IAAI,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gBAAgB,SAAS,mDAAmD;gBAClG,mGAAmG;gBACnG,8FAA8F,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,qBAAqB;IACrB,2CAA2C;IAE3C,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CACV,IAAI,kBAAkB,sEAAsE;gBAC5F,yEAAyE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,UAAU,CAAC,IAAI,CACb,GAAG,yCAAyC,CAC1C,UAAU,EACV,qBAAqB,EACrB,kBAAkB,EAClB;QACE,GAAG,kCAAkC;QACrC,CAAC,kBAAkB,CAAC,EAAE,uBAAuB;KAC9C,CACF,CACF,CAAC;IAEF,MAAM,4BAA4B,GAAG,yCAAyC,CAAC,0BAA0B,CACvG,mBAAmB,EACnB,2BAA2B,CAC5B,CAAC;IAEF,UAAU,CAAC,IAAI,CACb,GAAG,uCAAuC,CAAC;QACzC,UAAU;QACV,kBAAkB;QAClB,uBAAuB;QACvB,UAAU,EAAE,mBAAmB;QAC/B,4BAA4B;QAC5B,kBAAkB;KACnB,CAAC,CACH,CAAC;IAEF,2FAA2F;IAC3F,kGAAkG;IAClG,iGAAiG;IACjG,yBAAyB;IACzB,UAAU,CAAC,IAAI,CACb,GAAG,yCAAyC,CAAC;QAC3C,UAAU;QACV,kBAAkB;KACnB,CAAC,CACH,CAAC;IAEF,2EAA2E;IAC3E,EAAE;IACF,8EAA8E;IAC9E,gFAAgF;IAChF,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,EAAE;IACF,oEAAoE;IACpE,6EAA6E;IAC7E,4EAA4E;IAC5E,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,4EAA4E;QAC5E,mEAAmE;QACnE,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,uEAAuE;QACvE,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,wEAAwE;QACxE,2EAA2E;QAC3E,mBAAmB;QACnB,MAAM,cAAc,GAClB,2BAA2B,CAAC,SAAS,CAAC,mBAAmB,CAAC;eACvD,CAAC,iBAAiB,IAAI,SAAS,IAAI,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC;QAC5E,IAAI,cAAc,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAChE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gBAAgB,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,8BAA8B;gBACzG,qGAAqG;gBACrG,kGAAkG;gBAClG,2EAA2E,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,EAAE;IACF,sFAAsF;IACtF,6FAA6F;IAC7F,4FAA4F;IAC5F,EAAE;IACF,iEAAiE;IACjE,0FAA0F;IAC1F,6FAA6F;IAC7F,8FAA8F;IAC9F,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,gGAAgG;IAChG,8DAA8D;IAC9D,EAAE;IACF,yFAAyF;IACzF,6FAA6F;IAC7F,wFAAwF;IACxF,8FAA8F;IAC9F,4DAA4D;IAC5D,IAAI,eAAe,EAAE,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,gDAAgD,EAAE,CAAC;YAC3G,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,mCAAmC,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;gBACtG,SAAS;YACX,CAAC;YAED,MAAM,gBAAgB,GAAG,UAAU;iBAChC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,mBAAmB,KAAK,iBAAiB,CAAC;iBAC1E,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrG,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAE3D,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,8BAA8B,iBAAiB,oCAAoC;gBACzG,sEAAsE;gBACtE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,6BAA6B;gBACnG,GAAG,SAAS,sFAAsF;gBAClG,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC;gBAC7F,gGAAgG;gBAChG,+FAA+F;gBAC/F,qBAAqB,4BAA4B,CAAC,aAAa,mCAAmC;gBAClG,iGAAiG;gBACjG,oGAAoG,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAiF;QACnG,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;QACtC,oBAAoB;QACpB,kBAAkB;QAClB,uBAAuB;QACvB,cAAc;QACd,eAAe;QACf,UAAU,EAAE,mBAAmB;QAC/B,qBAAqB,EAAE,8BAA8B;QACrD,2BAA2B;QAC3B,kBAAkB;QAClB,2BAA2B;QAC3B,cAAc,EAAE,sBAAsB;QACtC,oBAAoB;QACpB,oBAAoB;QACpB,gBAAgB;QAChB,6BAA6B;QAC7B,kBAAkB,EAAE,2BAA2B;QAC/C,cAAc;QACd,mBAAmB,EAAE,cAAc;YACjC,CAAC,CAAC,CAAC,mBAAmB,IAAI,2BAA2B,CAAC,GAAG,CAAC;YAC1D,CAAC,CAAC,2BAA2B,CAAC,GAAG;QACnC,mGAAmG;QACnG,gFAAgF;QAChF,6FAA6F;QAC7F,2FAA2F;QAC3F,eAAe,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACpE,sGAAsG;QACtG,iBAAiB,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACxE,wFAAwF;QACxF,yFAAyF;QACzF,yFAAyF;QACzF,gEAAgE;QAChE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACvF,UAAU,EAAE,UAAU,CAAC,+BAA+B;KACvD,CAAC;IAEF,sEAAsE;IACtE,yFAAyF;IACzF,+EAA+E;IAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAqB,CAAC;IACtD,MAAM,kBAAkB,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CACpD,yCAAyC,CAAC,qBAAqB,CAC7D,SAAS,EACT,cAAc,EACd,gBAAgB,CACjB,CACF,CAAC;IAEF,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;QACtC,oBAAoB;QACpB,kBAAkB;QAClB,uBAAuB;QACvB,cAAc;QACd,eAAe;QACf,UAAU,EAAE,mBAAmB;QAC/B,qBAAqB,EAAE,8BAA8B;QACrD,2BAA2B;QAC3B,kBAAkB;QAClB,2BAA2B;QAC3B,cAAc,EAAE,sBAAsB;QACtC,oBAAoB;QACpB,oBAAoB;QACpB,gBAAgB;QAChB,6BAA6B;QAC7B,kBAAkB,EAAE,2BAA2B;QAC/C,cAAc;QACd,mBAAmB,EAAE,cAAc;YACjC,CAAC,CAAC,CAAC,mBAAmB,IAAI,2BAA2B,CAAC,GAAG,CAAC;YAC1D,CAAC,CAAC,2BAA2B,CAAC,GAAG;QACnC,kGAAkG;QAClG,+DAA+D;QAC/D,eAAe,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACpE,sGAAsG;QACtG,iBAAiB,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACxE,wFAAwF;QACxF,yFAAyF;QACzF,yFAAyF;QACzF,gEAAgE;QAChE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACvF,UAAU,EAAE,kBAAkB;KAC/B,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Operations Shared Schemas\n *\n * Reusable operation schemas for bulk actions and common operations\n */\n\n\nimport {\n EnumLikeType,\n ExpiresInDurationSchema,\n PrimitiveZodType,\n getImpersonalizeMaskValue,\n getImpersonalizeTreatment,\n getZodObjectShape,\n getZodType,\n isBackendOnlyField,\n isDiscriminatorField,\n isExcludedFromCreate,\n isExcludedFromUpdate,\n isBusinessKeyField,\n isZodObject,\n isSummaryField,\n isTemplatableFileField,\n isUniqueField,\n isVirtualField,\n SingleFileValueSchema,\n toPatchOptionalField,\n mainSchemaFieldIsClearable,\n unwrapSchema,\n getDataCategories,\n} from '@wildo-ai/zod-decorators';\nimport { z } from 'zod';\nimport { ErrorType } from '../errors/errors.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind, RetentionStatus, RetentionStatusSchema } from '../compliance/privacy/impersonalization.shared.schemas';\nimport {\n buildImpersonalizeScrubPatch,\n collectDeclaredPersonalDataFields,\n IMPERSONALIZE_MASK_CONSTANT,\n isImpersonalizeNeverScrubFloorField,\n resolveImpersonalizeMaskValue,\n resolveImpersonalizeResetValue,\n} from '../compliance/privacy/impersonalization-scrub.shared.utils';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { unknownPersonalDataCategories } from '../compliance/privacy/personal-data-category.shared.schemas';\n/*\n * entrypoint-closure-waiver: this root-reachable module imports the external-data AUTHORING\n * contract, which only `@wildo-ai/saas-models/external-data` publishes (see\n * `external-data.exports.ts` for why that subpath exists).\n *\n * MEASURED SAFE 2026-08-29 by the probe `package-public-entrypoints.md` prescribes — a consumer\n * importing ONLY the package root, re-exporting these surfaces and deriving their parameter types\n * so declaration emit must WRITE them rather than alias them, compiled with `declaration: true`:\n * zero TS2742 / TS2883 / TS7056, and the emitted `.d.ts` names `@wildo-ai/saas-models` with no\n * `node_modules/...` path anywhere in it.\n *\n * The mechanism, so the next reader need not re-derive it: every crossing here is an EXPLICIT\n * ANNOTATION inside this package, so TypeScript emits a RELATIVE intra-package import in our own\n * `.d.ts` — which resolves by PATH for any consumer, whatever the exports map says. TS2742 bites\n * only when TypeScript must INVENT a specifier for an INFERRED type. Re-run the probe if a\n * root-exported contract here ever starts inferring one.\n */\nimport { HttpApiResourceBindingSchema, HttpApiTransportDialect, assertHttpApiBindingDialectCoherence } from '../http-api-binding/http-api-binding.shared.schemas';\nimport {\n ExternalDataDestinationPopulation,\n ExternalDataFieldCoercion,\n ExternalDataMappingEntryKind,\n ExternalDataPipelineDeclarationSchema,\n assertExternalDataPipelineDeclarationCoherence,\n} from '../external-data/external-data-pipeline.shared.schemas';\nimport {\n M2MNotificationDefinition,\n UserNotificationDefinition,\n} from '../notifications/notifications.shared.schemas';\nimport { HttpMethod } from '../requests/http-requests.shared';\nimport type { TokenGenerationConfig, TokenRevocationConfig } from '../security/authentications/consumable-token.shared.schemas';\nimport { ConsumableToken_ConsumptionMode, TokenAuthenticationPolicy } from '../security/authentications/consumable-token.shared.schemas';\nimport {\n OPERATION_VARIANT_KEY,\n type AnyResourceConfiguration,\n type CollectionViewFields_List,\n RequiredFeaturesConfig,\n RequiredFeaturesNormalized,\n Resources_BulkOperationBaseSchema,\n Resources_Filter_BaseSchema,\n Resources_Filter_DateRangeSchema,\n Resources_PaginationRequestSchema,\n createPaginationRequestSchema,\n createPaginationResponseMetadataSchema,\n ResourceConfiguration,\n ResourceConfiguration_Operation_ApiCall,\n ResourceConfiguration_Operation,\n ResourceConfiguration_OperationVariant_BuilderParameters,\n ResourceConfiguration_Operation_BuilderParameters,\n ResourceConfiguration_BuilderParameters,\n ResourceConfiguration_InheritanceSchemaDefinition,\n ResourceConfiguration_ResourceRelationships,\n ResourceGeneratedOperationKind,\n ResourcePaginatedResponseResultSchema,\n ResourceSearchQueryRequestResult,\n ResourceSystemAccessMode,\n PersistenceAdapter,\n isPersistenceAdapter,\n SortOrder,\n ValidOperationKeys,\n ResourceCollectionExportConfig,\n ResourceCollectionExportResponseSchema,\n} from './resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier, ResourceType } from './resources.shared.core.definitions';\nimport {\n PRIMARY_SCOPE_FIELD_IDENTIFIERS,\n PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE,\n FIELD_IDENTIFIER_TO_PRIMARY_SCOPE,\n RelationshipNature,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourceOperation_ServiceRuntimeMode,\n ResourceParentResourceRequirement,\n ResourcePrimaryScope,\n ResourceRelationship,\n ResourceRelationshipBulkAction,\n ResourceRelationshipBulkActionResultSchema,\n ResourceRelationshipBulkClearOperationRequestSchema,\n ResourceRelationshipBulkCreateOperationRequestSchema,\n ResourceRelationshipBulkLinkOperationRequestSchema,\n ResourceRelationshipBulkReplaceOperationRequestSchema,\n ResourceRelationshipBulkSetOperationRequestSchema,\n ResourceRelationshipBulkUnlinkOperationRequestSchema,\n ResourceRelationshipDeclaration,\n ResourceRelationshipAccessScopeStrategy,\n ResourceRelationshipCardinality,\n ResourceTranspositionPolicy\n} from './resources.shared.schemas';\n\nimport { createResourcesRelationship } from './resources-relationships.shared.factory';\nimport { Resources_SharedUtils } from './resources.shared.utils';\nimport { ResourcesConfigOperationsDtosBuilderUtils } from './utils/resources-config-operations.dtos-builder.utils';\nimport { ResourcesSummaryUtils } from './utils/resources-summary.utils';\nimport { collectTemplatableFileFieldPaths, stripTemplatableFileFieldsRecursively } from './utils/templatable-file-fields.shared.utils';\nimport { selectByPersistenceAdapter, type PersistenceAdapterCases } from './utils/persistence-adapter-discrimination.shared.utils';\nimport {\n isServiceResolvableDefaultOperation,\n SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES,\n URL_BEARING_OPERATION_VARIANT_TYPES,\n} from './utils/resource-operation-type-guards.utils';\n\n// --------------------------------\n// Error Helpers\n// --------------------------------\n\n/**\n * Creates a configuration error with ErrorType.CONFIGURATION\n * Used for resource configuration validation errors at build time\n */\n/**\n * Reject an `.impersonalizeWith()` treatment declared BELOW the top level of a retention-governed\n * resource's schema (gate G-FILE / scrub-coverage).\n *\n * The impersonalize writer builds its `$set` from the TOP-LEVEL shape only, and file links are stored\n * under a dotted canonical path (`billingContact.signedMandate`). A nested treatment therefore never\n * reaches the scrub patch and never matches a linked file's `linkedFieldName`: the row flips to\n * RETAINED while the nested personal field — and any file beneath it — survive fully intact, with an\n * audit event asserting the record was impersonalized.\n *\n * Recursive scrubbing (dotted-path patches + the matching file-path recursion) is deliberately out of\n * v1 scope, so this fails at CONFIG BUILD instead of silently under-scrubbing at erasure time. Walks\n * nested ZodObjects (through optional/nullable/default/array wrappers) and every discriminated-union\n * option, mirroring how the runtime resolves field paths.\n */\nfunction assertNoNestedImpersonalizeTreatment(\n schema: z.ZodTypeAny,\n resourceIdentifier: string,\n): void {\n const visited = new Set<unknown>();\n\n const walk = (candidate: z.ZodTypeAny | undefined, path: string, isTopLevel: boolean): void => {\n if (!candidate || visited.has(candidate)) return;\n visited.add(candidate);\n\n if (!isTopLevel && getImpersonalizeTreatment(candidate) !== undefined) {\n throw createConfigurationError(\n `[${resourceIdentifier}] field '${path}' declares an impersonalize treatment, but it is NESTED. ` +\n `The scrub writes a top-level $set only, so a nested treatment would be silently ignored — the row ` +\n `would flip to RETAINED with '${path}' (and any file linked under it) fully intact. Move the field to ` +\n `the top level, or scrub the whole containing field instead (REMOVE on the parent object).`\n );\n }\n\n const shape = getZodObjectShape(unwrapSchema(candidate) ?? candidate);\n for (const [childName, childSchema] of Object.entries(shape ?? {})) {\n walk(childSchema as z.ZodTypeAny, path ? `${path}.${childName}` : childName, false);\n }\n };\n\n // Top-level fields are legitimately treatable; only their DESCENDANTS are the problem.\n const topLevelShape = getZodObjectShape(schema);\n for (const [fieldName, fieldSchema] of Object.entries(topLevelShape ?? {})) {\n const unwrapped = unwrapSchema(fieldSchema as z.ZodTypeAny) ?? (fieldSchema as z.ZodTypeAny);\n const nestedShape = getZodObjectShape(unwrapped);\n for (const [childName, childSchema] of Object.entries(nestedShape ?? {})) {\n walk(childSchema as z.ZodTypeAny, `${fieldName}.${childName}`, false);\n }\n }\n}\n\nfunction createConfigurationError(message: string): Error {\n const error = new Error(message);\n (error as any).type = ErrorType.CONFIGURATION;\n return error;\n}\n\n/**\n * Creates a validation error with ErrorType.VALIDATION\n * Used for runtime data validation errors\n */\nfunction createValidationError(message: string): Error {\n const error = new Error(message);\n (error as any).type = ErrorType.VALIDATION;\n return error;\n}\n\n/**\n * Reads the shared authority rather than re-listing the members: the URL-bearing\n * set is consumed by the route-mount gate, the URL/DTO resolver and this factory,\n * and a variant type added to one copy but not another silently changes which\n * operations get routes.\n */\nfunction isUrlisableOperationVariantType(variantType: ResourceOperationVariantType): boolean {\n return URL_BEARING_OPERATION_VARIANT_TYPES.includes(variantType);\n}\n\n/**\n * The operations a `retentionPolicy` resource must expose to the SERVICE dispatch\n * layer, with the retention primitive that needs each one.\n *\n * Every entry is consumed by BOTH halves of the retention operation contract — the\n * presence check (is it declared in `coreOperations`?) and the resolvability check\n * (does it have a default variant `getServiceOperationPathDefault` can serve?) — so\n * adding a fourth primitive here extends both at once. Listing the ops twice is how\n * a primitive gets a presence guard and no resolvability guard.\n */\nconst RETENTION_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS: readonly {\n operation: CoreResourceOperation;\n primitive: string;\n why: string;\n}[] = [\n {\n operation: CoreResourceOperation.UPDATE_MANY,\n primitive: 'updateManyAsSystem',\n why: 'the impersonalize writer scrubs rows in place via updateManyAsSystem',\n },\n {\n operation: CoreResourceOperation.READ,\n primitive: 'readRetainedAsSystem',\n why: 'the see-through read primitive readRetainedAsSystem surfaces a single retained record via READ',\n },\n {\n operation: CoreResourceOperation.LIST,\n primitive: 'listRetainedAsSystem',\n why: 'the see-through read primitive listRetainedAsSystem surfaces retained records via LIST',\n },\n];\n\nfunction assertOperationPathKeySegment(value: string, label: string, operation: string): void {\n if (value.includes(' | ')) {\n throw createConfigurationError(\n `Operation '${operation}' cannot use ${label} '${value}' because operation path keys reserve the delimiter ' | '`,\n );\n }\n}\n\nfunction createGeneratedRelationshipBulkOperations(\n operations: any[],\n relevantRelationships: ResourceRelationship[],\n resourceIdentifier: ResourceType,\n allResourceFieldIdentifiers: Partial<Record<ResourceType, string>> | Record<string, string>\n): any[] {\n const baseBulkUpdateOperations = operations.filter((operation) =>\n isUrlisableOperationVariantType(operation.variantType)\n && operation.operationIdentifier === CoreResourceOperation.UPDATE\n && 'isBulkOperation' in operation\n && operation.isBulkOperation === true\n );\n\n if (baseBulkUpdateOperations.length > 1) {\n throw createConfigurationError(\n `[${resourceIdentifier}] generated bulk relationship operations require exactly one API bulk UPDATE base operation, but found ${baseBulkUpdateOperations.length}`\n );\n }\n\n const [baseBulkUpdateOperation] = baseBulkUpdateOperations;\n\n if (!baseBulkUpdateOperation) {\n return [];\n }\n\n const generatedOperations: any[] = [];\n const knownOperationIdentifiers = new Set(\n operations.map((operation) => String(operation.operationIdentifier))\n );\n\n for (const relationship of relevantRelationships) {\n const relationshipField = Resources_SharedUtils.resolveRelationshipObjectIdentityForResource(\n relationship,\n resourceIdentifier,\n allResourceFieldIdentifiers\n ).objectFieldName;\n const allowedActions = Resources_SharedUtils.resolveAllowedBulkRelationshipActionsForResource(\n relationship,\n resourceIdentifier\n );\n\n for (const action of allowedActions) {\n const operationIdentifier = Resources_SharedUtils.buildRelationshipBulkOperationIdentifier(\n action,\n relationshipField\n );\n\n if (knownOperationIdentifiers.has(operationIdentifier)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] generated bulk relationship operation \"${operationIdentifier}\" collides with an existing operation identifier`\n );\n }\n\n knownOperationIdentifiers.add(operationIdentifier);\n\n const requestDto = (() => {\n switch (action) {\n case ResourceRelationshipBulkAction.SET:\n return ResourceRelationshipBulkSetOperationRequestSchema;\n case ResourceRelationshipBulkAction.CLEAR:\n return ResourceRelationshipBulkClearOperationRequestSchema;\n case ResourceRelationshipBulkAction.CREATE:\n return ResourceRelationshipBulkCreateOperationRequestSchema;\n case ResourceRelationshipBulkAction.LINK:\n return ResourceRelationshipBulkLinkOperationRequestSchema;\n case ResourceRelationshipBulkAction.UNLINK:\n return ResourceRelationshipBulkUnlinkOperationRequestSchema;\n case ResourceRelationshipBulkAction.REPLACE:\n return ResourceRelationshipBulkReplaceOperationRequestSchema;\n }\n })();\n\n generatedOperations.push({\n ...baseBulkUpdateOperation,\n operationIdentifier,\n isDefault: false,\n isOperationDefault: false,\n isBulkOperation: true,\n resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n requestDto,\n // Generated bulk-relationship ops own an explicit request contract (the\n // bulk action schema above) — preserve it verbatim, never rebuild.\n hasCustomRequestDto: true,\n responseDto: ResourceRelationshipBulkActionResultSchema,\n hasCustomResponseDto: true,\n basicPrefixOperation: undefined,\n notificationBadgeOperations: [],\n userNotifications: [],\n m2mNotifications: [],\n tokenGeneration: undefined,\n tokenRevocation: undefined,\n });\n }\n }\n\n return generatedOperations;\n}\n\nexport function reconcileGeneratedRelationshipBulkOperations(\n resourceConfigurations: Record<string, AnyResourceConfiguration>,\n allResourceRelationships: ResourceRelationship[],\n allResourceFieldIdentifiers: Partial<Record<ResourceType, string>> | Record<string, string>\n): void {\n for (const [resourceType, resourceConfiguration] of Object.entries(resourceConfigurations)) {\n if (!Array.isArray(resourceConfiguration.operations)) {\n continue;\n }\n\n const currentResourceType = resourceType as ResourceType;\n const nonGeneratedOperations = resourceConfiguration.operations.filter(\n (operation) => !Resources_SharedUtils.parseRelationshipBulkOperationIdentifier(String(operation.operationIdentifier))\n );\n const relevantRelationships = allResourceRelationships.filter(\n (relationship) =>\n relationship.resourceType1 === currentResourceType\n || relationship.resourceType2 === currentResourceType\n );\n\n resourceConfiguration.operations = [\n ...nonGeneratedOperations,\n ...createGeneratedRelationshipBulkOperations(\n nonGeneratedOperations,\n relevantRelationships,\n currentResourceType,\n allResourceFieldIdentifiers\n ),\n ];\n }\n}\n\n/**\n * Derive the CSV/JSON export companion of every LIST/SEARCH operation that declared\n * `collectionExport`.\n *\n * ## Why derived rather than authored\n *\n * The export must be exactly as reachable as the listing it exports — never more. Copying the source\n * operation wholesale and overriding only what must differ makes that structural: an author cannot\n * give the export wider `roles`, a different parent-scope path, or a laxer variant, because they\n * never write it. It is the same construction `createGeneratedFileRegenerateOperations` uses one\n * function above.\n *\n * ## What is deliberately CLEARED rather than inherited\n *\n * `mcp` is the one that matters. A LIST curated onto an MCP server is a PAGINATED read tool; its\n * export companion returns the whole result set in a single call, which is a different risk profile.\n * Spreading the source operation would silently turn \"this app declared an export\" into \"this app\n * grew a new agent tool that exfiltrates the table\", so the flag is dropped and an application that\n * genuinely wants an agent-callable export has to say so.\n *\n * The notification/token fields are cleared for the same reason they are on the regenerate\n * companion: they describe effects of the SOURCE operation and firing them again on an export would\n * double-notify.\n */\nfunction createGeneratedCollectionExportOperations(params: {\n operations: any[];\n resourceIdentifier: ResourceType;\n}): any[] {\n const knownOperationIdentifiers = new Set(\n params.operations.map((operation) => String(operation.operationIdentifier)),\n );\n\n const exportOperations: any[] = [];\n\n for (const operation of params.operations) {\n const exportConfig = (operation as { collectionExport?: ResourceCollectionExportConfig }).collectionExport;\n if (!exportConfig) {\n continue;\n }\n\n const sourceOperationIdentifier = String(operation.operationIdentifier);\n\n if (!isUrlisableOperationVariantType(operation.variantType)) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] operation \"${sourceOperationIdentifier}\" declares collectionExport but is not URL-bearing; an export has no route to live on`\n );\n }\n\n // The source's CORE verb decides which service call the export re-runs, and it is the only thing\n // that can: a custom operation carries LIST/SEARCH semantics through `resourceOperationLike`.\n const sourceCoreOperation = (operation.resourceOperationLike ?? operation.operationIdentifier) as CoreResourceOperation;\n if (sourceCoreOperation !== CoreResourceOperation.LIST && sourceCoreOperation !== CoreResourceOperation.SEARCH) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] operation \"${sourceOperationIdentifier}\" declares collectionExport but is neither LIST nor SEARCH (resolved core operation: ${String(sourceCoreOperation)})`\n );\n }\n\n // Empty arrays are a startup error, never a silent \"offer everything\" — the same rule\n // `mcp.servers` follows, so the declaration always reads as \"exactly these\".\n if (!exportConfig.formats || exportConfig.formats.length === 0) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] operation \"${sourceOperationIdentifier}\" declares collectionExport with no formats; declare at least one, or omit collectionExport entirely`\n );\n }\n if (!exportConfig.rowScopes || exportConfig.rowScopes.length === 0) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] operation \"${sourceOperationIdentifier}\" declares collectionExport with no rowScopes; declare at least one, or omit collectionExport entirely`\n );\n }\n if (exportConfig.maximumExportedRows !== undefined && exportConfig.maximumExportedRows <= 0) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] operation \"${sourceOperationIdentifier}\" declares a non-positive collectionExport.maximumExportedRows; omit it for no ceiling`\n );\n }\n\n const operationIdentifier = Resources_SharedUtils.buildGeneratedCollectionExportOperationIdentifier(sourceOperationIdentifier);\n if (knownOperationIdentifiers.has(operationIdentifier)) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] generated collection export operation \"${operationIdentifier}\" collides with an existing operation identifier`\n );\n }\n knownOperationIdentifiers.add(operationIdentifier);\n\n exportOperations.push({\n ...operation,\n operationIdentifier,\n isDefault: false,\n isOperationDefault: false,\n isBulkOperation: false,\n httpVerb: HttpMethod.GET,\n // Keeps the URL builder treating it as collection-level, and gives a SEARCH export the\n // `search` segment its source already has — so the two exports of one resource cannot collide.\n resourceOperationLike: sourceCoreOperation,\n generatedOperation: {\n kind: ResourceGeneratedOperationKind.GENERATED_COLLECTION_EXPORT,\n sourceOperationIdentifier,\n sourceCoreOperation,\n export: exportConfig,\n },\n // The export takes the SOURCE's query contract (filters, sort, q, pagination) verbatim plus its\n // own two selectors, so \"export what I am looking at\" is expressible without a second grammar.\n responseDto: ResourceCollectionExportResponseSchema,\n internalDto: ResourceCollectionExportResponseSchema,\n hasCustomResponseDto: true,\n // Cleared, not inherited — see this function's docstring.\n mcp: undefined,\n collectionExport: undefined,\n basicPrefixOperation: undefined,\n notificationBadgeOperations: [],\n userNotifications: [],\n m2mNotifications: [],\n tokenGeneration: undefined,\n tokenRevocation: undefined,\n });\n }\n\n return exportOperations;\n}\n\nfunction createGeneratedFileRegenerateOperations(params: {\n operations: any[];\n resourceIdentifier: ResourceType;\n resourceFieldIdentifier: string;\n mainSchema: z.ZodTypeAny;\n generatedFileDiscoverySchema?: z.ZodTypeAny;\n persistenceAdapter?: unknown;\n}): any[] {\n const generatedFileDiscoverySchema = params.generatedFileDiscoverySchema ?? params.mainSchema;\n const collectedFields = collectTemplatableFileFieldPaths(generatedFileDiscoverySchema);\n const arrayContainedFields = collectedFields.filter((field) => field.isInsideArray);\n if (arrayContainedFields.length > 0) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] generated PDF file fields inside arrays or dynamic containers are not supported in v1: ${arrayContainedFields.map((field) => field.fieldName).join(', ')}`\n );\n }\n\n const generatedFields = collectedFields.filter(\n (field) => !field.isInsideArray,\n );\n if (generatedFields.length === 0) {\n return [];\n }\n /**\n * A generated document is MATERIALIZED: rendering it writes a FILES metadata row that must\n * commit in the SAME native transaction as the row that owns it, or a failure between the two\n * leaves either a dangling document reference or an orphaned blob. So the only question this\n * guard can honestly ask of a DECLARATION is whether the declared adapter is one that HAS a\n * transactional local store at all.\n *\n * ## What changed, and why the old shape was wrong rather than merely conservative\n *\n * This refused every adapter except MongoDB, on the grounds that file metadata was pinned to\n * MongoDB, so a generated PDF on a PostgreSQL resource would have crossed adapters. That reason\n * is gone: FILES was un-pinned and now FOLLOWS the application's default adapter\n * (`files.shared.resources-config.schemas.ts:43-67`), precisely so a resource and its file\n * metadata share one native transaction. A PostgreSQL application whose FILES is therefore also\n * PostgreSQL was being refused at authoring time for a boundary that no longer exists.\n *\n * The ASYMMETRY was the tell, and it is the reason this could not be left alone: `undefined` —\n * \"follow the application default\" — was and is admitted, so the identical resource in the\n * identical PostgreSQL application was already authorable by SAYING LESS. A guard whose answer\n * depends on whether a redundant declaration was written is testing the declaration, not the\n * capability.\n *\n * ## What still refuses, and why that half is load-bearing\n *\n * `INTROSPECTION` rows are recomputed per read — there is no store and no transaction. `HTTP_API`\n * rows live in someone else's system and are read-only by construction. Neither can own a\n * locally-materialized document row, and unlike the PostgreSQL case that is knowable from the\n * declaration alone, so refusing at authoring time is strictly better than discovering it on the\n * first write. `getDatabaseServiceForAdapter` says the same thing at runtime, for the same two\n * adapters, in the same words.\n *\n * ## Shape\n *\n * Expressed as an exhaustive `PersistenceAdapterCases` map rather than a comparison, so a fifth\n * backing kind is a COMPILE error here instead of silently inheriting whichever arm an `else`\n * happened to mean — the failure mode `selectByPersistenceAdapter` exists to remove, and the one\n * the previous `!== MONGODB` shape genuinely had in the other direction (it would have refused a\n * future stored adapter without anyone deciding to).\n *\n * `isPersistenceAdapter` runs FIRST so an erased or unknown declaration keeps refusing through\n * `createConfigurationError` with the resource and the field list named, rather than through the\n * selector's plain `Error`. This factory is a shared-tier authoring surface: its refusals are\n * read by an application author, and the field list is the actionable half.\n *\n * ## What this guard deliberately does NOT decide\n *\n * It cannot see the application's default adapter, so it cannot tell whether THIS resource and\n * FILES resolve to the same store — a resource declaring `POSTGRESQL` inside a MongoDB-default\n * application is a real cross-adapter boundary and must still be refused. That refusal is made\n * where the resolved adapters are actually known, at\n * `services-registry-handler.backend.service.ts` →\n * `assertGeneratedFileMaterializationCommitsWithRow`, which asks the persistence unit of work\n * whether `{this resource, FILES-as-ATOMIC}` can commit atomically and throws\n * `MIXED_PERSISTENCE_ADAPTERS` when it cannot. It gates all three materialization entry points\n * (create, createMany, regenerate) and, unlike this one, also covers the undeclared case this\n * guard has always waved through — which is why relaxing here narrows nothing.\n */\n const GENERATED_DOCUMENT_MATERIALIZATION_SUPPORT: PersistenceAdapterCases<boolean> = {\n [PersistenceAdapter.MONGODB]: true,\n [PersistenceAdapter.POSTGRESQL]: true,\n [PersistenceAdapter.INTROSPECTION]: false,\n [PersistenceAdapter.HTTP_API]: false,\n };\n if (params.persistenceAdapter !== undefined) {\n const declaredAdapter = params.persistenceAdapter;\n const materializationIsSupported = isPersistenceAdapter(declaredAdapter)\n && selectByPersistenceAdapter(declaredAdapter, GENERATED_DOCUMENT_MATERIALIZATION_SUPPORT);\n if (!materializationIsSupported) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] generated PDF file fields require a persistence adapter with a transactional local store, `\n + `so that the generated file's metadata row commits with the row that owns it `\n + `(declared adapter: '${String(declaredAdapter)}'; supported: `\n + `'${PersistenceAdapter.MONGODB}', '${PersistenceAdapter.POSTGRESQL}', or no declaration to follow the application default): `\n + `${generatedFields.map((field) => field.fieldName).join(', ')}`\n );\n }\n }\n\n const baseUpdateOperation = params.operations.find((operation) =>\n isUrlisableOperationVariantType(operation.variantType)\n && operation.operationIdentifier === CoreResourceOperation.UPDATE\n && 'isBulkOperation' in operation\n && operation.isBulkOperation !== true\n && operation.isOperationDefault === true\n );\n if (!baseUpdateOperation) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] generated file regenerate operations require a default non-bulk URL-bearing UPDATE operation`\n );\n }\n\n const knownOperationIdentifiers = new Set(\n params.operations.map((operation) => String(operation.operationIdentifier))\n );\n const responseDto = z.object({\n file: SingleFileValueSchema,\n resource: generatedFileDiscoverySchema,\n });\n\n return generatedFields.map(({ fieldName }) => {\n const operationIdentifier = Resources_SharedUtils.buildGeneratedFileRegenerateOperationIdentifier(fieldName);\n if (knownOperationIdentifiers.has(operationIdentifier)) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] generated file regenerate operation \"${operationIdentifier}\" collides with an existing operation identifier`\n );\n }\n knownOperationIdentifiers.add(operationIdentifier);\n\n return {\n ...baseUpdateOperation,\n operationIdentifier,\n isDefault: false,\n isOperationDefault: false,\n isBulkOperation: false,\n httpVerb: HttpMethod.POST,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n generatedOperation: {\n kind: ResourceGeneratedOperationKind.GENERATED_FILE_REGENERATE,\n fieldName,\n },\n requestDto: z.object({}),\n // Generated file-regenerate ops own their request contract: an intentionally\n // empty body (regeneration is UPDATE-like but takes no input). Preserve it,\n // do not rebuild from mainSchema decorators.\n hasCustomRequestDto: true,\n responseDto,\n internalDto: responseDto,\n hasCustomResponseDto: true,\n basicPrefixOperation: undefined,\n notificationBadgeOperations: [],\n userNotifications: [],\n m2mNotifications: [],\n tokenGeneration: undefined,\n tokenRevocation: undefined,\n };\n });\n}\n\n// --------------------------------\n// Token Config Validation\n// --------------------------------\n\nconst BULK_MUTATION_CORE_OPERATIONS: ReadonlySet<CoreResourceOperation> = new Set([\n CoreResourceOperation.CREATE_MANY,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE_MANY,\n]);\nconst TOKEN_STATE_EFFECT_UNSUPPORTED_CORE_OPERATIONS: ReadonlySet<CoreResourceOperation> = new Set([\n ...BULK_MUTATION_CORE_OPERATIONS,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.COUNT,\n]);\n\nfunction isCoreBulkMutationOperation(\n operationIdentifier: unknown,\n): boolean {\n return BULK_MUTATION_CORE_OPERATIONS.has(\n operationIdentifier as CoreResourceOperation,\n );\n}\n\nfunction isTokenStateEffectUnsupportedOperation(\n operationIdentifier: unknown,\n): boolean {\n return TOKEN_STATE_EFFECT_UNSUPPORTED_CORE_OPERATIONS.has(\n operationIdentifier as CoreResourceOperation,\n );\n}\n\n/**\n * Validates tokenGeneration configuration at build time.\n * Catches common mistakes before the app starts.\n */\nfunction validateTokenGenerationConfig(\n config: TokenGenerationConfig,\n resourceIdentifier: string,\n operationIdentifier: string,\n): void {\n const prefix = `[${resourceIdentifier}.${operationIdentifier}] tokenGeneration`;\n\n // BOUNDED_REUSE requires maxUses\n if (config.consumptionMode === ConsumableToken_ConsumptionMode.BOUNDED_REUSE) {\n if (config.maxUses == null || config.maxUses < 1) {\n throw createConfigurationError(\n `${prefix}: consumptionMode is BOUNDED_REUSE but maxUses is ${config.maxUses ?? 'missing'}. ` +\n `BOUNDED_REUSE tokens must specify maxUses >= 1.`,\n );\n }\n }\n\n // maxUses should NOT be set for non-BOUNDED_REUSE modes (likely a mistake)\n if (config.consumptionMode !== ConsumableToken_ConsumptionMode.BOUNDED_REUSE && config.maxUses != null) {\n throw createConfigurationError(\n `${prefix}: maxUses is set (${config.maxUses}) but consumptionMode is ${config.consumptionMode}. ` +\n `maxUses is only valid for BOUNDED_REUSE tokens. Remove maxUses or change consumptionMode.`,\n );\n }\n\n // tokenType is required\n if (!config.tokenType) {\n throw createConfigurationError(`${prefix}: tokenType is required.`);\n }\n\n // expiresIn is required\n if (config.expiresIn == null) {\n throw createConfigurationError(`${prefix}: expiresIn is required (static value or derived function).`);\n }\n\n // If expiresIn is static, validate shape (minutes, hours, days only; value >= 1)\n if (typeof config.expiresIn !== 'function') {\n const result = ExpiresInDurationSchema.safeParse(config.expiresIn);\n if (!result.success) {\n const msg = result.error.issues.map((i) => i.message).join('; ');\n throw createConfigurationError(`${prefix}: expiresIn validation failed: ${msg}`);\n }\n }\n\n // W7.3b: createsOneOffSession requires consumeAt\n if (config.createsOneOffSession && !config.consumeAt) {\n throw createConfigurationError(\n `${prefix}: createsOneOffSession is true but consumeAt is missing. ` +\n `Specify 'EXCHANGE' or 'TARGET_OPERATION'.`,\n );\n }\n\n // W7.3b: consumeAt without createsOneOffSession is a mistake\n if (config.consumeAt && !config.createsOneOffSession) {\n throw createConfigurationError(\n `${prefix}: consumeAt is set ('${config.consumeAt}') but createsOneOffSession is not true. ` +\n `consumeAt only applies to one-off session tokens.`,\n );\n }\n}\n\n/**\n * Validates tokenRevocation configuration at build time.\n */\nfunction validateTokenRevocationConfig(\n config: TokenRevocationConfig,\n resourceIdentifier: string,\n operationIdentifier: string,\n): void {\n const prefix = `[${resourceIdentifier}.${operationIdentifier}] tokenRevocation`;\n\n if (!config.tokenTypes || config.tokenTypes.length === 0) {\n throw createConfigurationError(`${prefix}: tokenTypes must be a non-empty array of token types to revoke.`);\n }\n}\n\n// --------------------------------\n// Required Features Normalization\n// --------------------------------\n\n/**\n * Normalizes requiredFeatures input to the full form.\n * - undefined → undefined (no features required)\n * - string[] → { features: [...], mode: 'OR' } (shorthand)\n * - full config → passed through as-is\n */\nfunction normalizeRequiredFeatures(input: RequiredFeaturesConfig | undefined): RequiredFeaturesNormalized | undefined {\n if (input === undefined) return undefined;\n if (Array.isArray(input)) {\n // Shorthand: string[] → { features: [...], mode: 'OR' }\n return { features: input, mode: 'OR' };\n }\n return input;\n}\n\n// --------------------------------\n// DTO Auto-Derivation Utilities\n// --------------------------------\n\n/**\n * @wildo_source:part:start saas.models.resource-config.system-managed-fields facet:layer:shared facet:audience:app-developer\n *\n * The field names the framework owns. They are removed from every generated CREATE and UPDATE\n * request contract, for every resource, whatever your schema declares and whatever a caller sends.\n *\n * Declaring one of these in a resource schema is fine and often necessary — the framework maintains\n * the value. What you cannot do is accept it from a client, default it in a form, or require it on a\n * create: the field is stripped before validation runs, so a form that collects it submits a value\n * that is discarded, and a schema that requires it rejects every request.\n *\n * | field | who writes it |\n * |---|---|\n * | `_id` | the persistence layer (or your own `.isPrimaryKey()` field, stored beneath it) |\n * | `createdAt` / `updatedAt` / `deletedAt` | the repository, on write |\n * | `createdByUserId` | the repository, stamped from the execution context on CREATE, immutable afterwards |\n * | `_version_db_doc` | the framework's optimistic-concurrency marker |\n *\n * The failure this prevents is quiet and was paid for once: a create form validating against a\n * reserved field that no form collects fails every submit with `expected string, received undefined`,\n * and the schema looks correct while it does. So the exclusion is unconditional and does not depend\n * on the resource author remembering `.excludeFromCreate()`.\n *\n * ⚠️ A NARROWER set — `_id`, `createdAt`, `updatedAt`, `deletedAt`, `_version_db_doc` — is\n * additionally *mandatory-discard*: even a trusted in-process system write cannot re-attach those\n * through `preserveServerInjectedFields`. `createdByUserId` is deliberately not in that set, because\n * an engine flow creating a row on somebody's behalf legitimately needs to stamp it.\n */\nconst SYSTEM_MANAGED_FIELDS = ['_id', 'createdAt', 'updatedAt', 'deletedAt', 'createdByUserId', '_version_db_doc'] as const;\n/** @wildo_source:part:end saas.models.resource-config.system-managed-fields */\n\n// PRIMARY_SCOPE_FIELD_IDENTIFIERS and getPrimaryScopeFieldIdentifier imported from resources.shared.schemas\n\n/**\n * Build a CREATE request DTO from the main schema using decorators.\n *\n * Excludes:\n * - System-managed fields (_id, createdAt, updatedAt, etc.)\n * - Virtual fields (computed, not stored)\n * - Fields with excludeFromCreate decorator\n *\n * NOTE: Backend-only fields (isBackendOnly) are NOT excluded from CREATE DTOs.\n * The isBackendOnly decorator controls RESPONSE filtering (what is returned to clients),\n * not REQUEST filtering (what can be set during creation). Backend operations need to\n * set fields like passwordHash, apiKey, etc. directly during resource creation.\n *\n * @param mainSchema - The main resource schema\n * @param customExclusions - Additional fields to exclude\n * @returns A new schema with only creatable fields\n */\nexport function buildCreateRequestDto<T extends z.ZodTypeAny>(\n mainSchema: T,\n customExclusions?: string[]\n): z.ZodTypeAny {\n try {\n const shape = getZodObjectShape(mainSchema);\n const createShape: Record<string, z.ZodTypeAny> = {};\n\n for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n const typedSchema = fieldSchema as z.ZodTypeAny;\n\n // Exclude system-managed fields\n if ((SYSTEM_MANAGED_FIELDS as readonly string[]).includes(fieldName)) continue;\n\n // Exclude primary scope field identifiers (auto-populated from context)\n if ((PRIMARY_SCOPE_FIELD_IDENTIFIERS as readonly string[]).includes(fieldName)) continue;\n\n // Exclude virtual fields (computed, not stored)\n if (isVirtualField(typedSchema)) continue;\n\n // Exclude explicitly marked fields\n if (isExcludedFromCreate(typedSchema)) continue;\n\n // Exclude generated file fields; clients cannot upload or author values\n // that are materialized by framework-owned operations.\n if (isTemplatableFileField(typedSchema)) continue;\n\n // NOTE: Backend-only fields are NOT excluded here.\n // isBackendOnly controls response filtering, not request filtering.\n // Backend operations need to set fields like passwordHash directly.\n\n // Exclude non-discriminator literals (fixed values auto-populated by backend)\n // Discriminator literals are kept for variant selection\n const unwrapped = unwrapSchema(typedSchema);\n if (getZodType(unwrapped) === 'literal' && !isDiscriminatorField(typedSchema)) continue;\n\n // Exclude custom exclusions\n if (customExclusions?.includes(fieldName)) continue;\n\n createShape[fieldName] = stripTemplatableFileFieldsRecursively(fieldSchema as z.ZodTypeAny);\n }\n\n return stripTemplatableFileFieldsRecursively(z.object(createShape));\n } catch {\n // If schema is not an object, return as-is\n return mainSchema;\n }\n}\n\n\n\n\n/**\n * Build an UPDATE request DTO from the main schema using decorators.\n *\n * Excludes:\n * - System-managed fields (_id, createdAt, updatedAt, etc.)\n * - Virtual fields (computed, not stored)\n * - Fields with excludeFromUpdate decorator\n *\n * NOTE: Backend-only fields (isBackendOnly) are NOT excluded from UPDATE DTOs.\n * The isBackendOnly decorator controls RESPONSE filtering (what is returned to clients),\n * not REQUEST filtering (what can be set during updates). Backend operations may need\n * to update fields like passwordHash, apiKey, etc. directly.\n *\n * All remaining fields are made optional for PATCH-style updates.\n *\n * @param mainSchema - The main resource schema\n * @param customExclusions - Additional fields to exclude\n * @returns A new partial schema with only updatable fields\n */\nfunction buildUpdateRequestDto<T extends z.ZodTypeAny>(\n mainSchema: T,\n customExclusions?: string[]\n): z.ZodTypeAny {\n try {\n const shape = getZodObjectShape(mainSchema);\n const updateShape: Record<string, z.ZodTypeAny> = {};\n\n for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n const typedSchema = fieldSchema as z.ZodTypeAny;\n\n // Exclude system-managed fields\n if ((SYSTEM_MANAGED_FIELDS as readonly string[]).includes(fieldName)) continue;\n\n // Exclude primary scope field identifiers (immutable, context-derived)\n if ((PRIMARY_SCOPE_FIELD_IDENTIFIERS as readonly string[]).includes(fieldName)) continue;\n\n // Exclude virtual fields (computed, not stored)\n if (isVirtualField(typedSchema)) continue;\n\n // Exclude explicitly marked fields\n if (isExcludedFromUpdate(typedSchema)) continue;\n\n // Exclude generated file fields; explicit regenerate operations own\n // refreshing these values instead of generic UPDATE payloads.\n if (isTemplatableFileField(typedSchema)) continue;\n\n // NOTE: Backend-only fields are NOT excluded here.\n // isBackendOnly controls response filtering, not request filtering.\n // Backend operations may need to update fields like passwordHash.\n\n // Exclude ALL literal fields (immutable after creation)\n const unwrapped = unwrapSchema(typedSchema);\n if (getZodType(unwrapped) === 'literal') continue;\n\n // Exclude custom exclusions\n if (customExclusions?.includes(fieldName)) continue;\n\n // Make field optional for PATCH-style update, peeling any `.default()` so\n // an omitted field is never re-materialized to its default and written\n // back over the stored value (see `toPatchOptionalField`).\n updateShape[fieldName] = toPatchOptionalField(\n stripTemplatableFileFieldsRecursively(fieldSchema as z.ZodTypeAny),\n );\n }\n\n return stripTemplatableFileFieldsRecursively(z.object(updateShape));\n } catch {\n // If schema is not an object, return as-is\n return mainSchema;\n }\n}\n\n/**\n * Derives the appropriate request DTO based on operation type.\n *\n * - CREATE: Uses buildCreateRequestDto (excludes excludeFromCreate fields)\n * - UPDATE: Uses buildUpdateRequestDto (excludes excludeFromUpdate fields, all partial)\n * - READ/DELETE and custom operations without an explicit DTO: empty object\n *\n * This is an early factory placeholder. The final DTO pass in\n * ResourcesConfigOperationsDtosBuilderUtils applies inherited schemas, the\n * shared no-body operation policy, and SEARCH query schemas derived from\n * collection-view metadata.\n *\n * @param operation - The operation identifier\n * @param mainSchema - The main resource schema\n * @param providedDto - Explicitly provided DTO (takes precedence)\n * @returns The appropriate request DTO schema\n */\nexport function deriveRequestDto<T extends z.ZodTypeAny>(\n operation: string,\n mainSchema: T,\n providedDto?: z.ZodTypeAny\n): z.ZodTypeAny {\n // If explicit DTO is provided, use it (for custom operations)\n if (providedDto !== undefined) {\n return stripTemplatableFileFieldsRecursively(providedDto);\n }\n\n // Auto-derive based on operation type\n switch (operation) {\n case CoreResourceOperation.CREATE:\n return buildCreateRequestDto(mainSchema);\n case CoreResourceOperation.UPDATE:\n return buildUpdateRequestDto(mainSchema);\n case CoreResourceOperation.READ:\n case CoreResourceOperation.DELETE:\n // READ and DELETE don't need request bodies (just URL params)\n return z.object({});\n default:\n // For custom operations without explicit DTO, return empty object\n // (custom operations should provide their own requestDto)\n return z.object({});\n }\n}\n\n// --------------------------------\n// Decorator Combination Validation\n// --------------------------------\n\n/**\n * Validates that decorated fields don't have invalid decorator combinations.\n *\n * Invalid combinations:\n * - isSummaryField + isBackendOnly: Backend-only fields can't be in summaries\n * - isDiscriminator + excludeFromCreate: Discriminator is required for create operations\n *\n * @param mainSchema - The main schema to validate\n * @param resourceIdentifier - Resource name for error messages\n * @throws Error if invalid decorator combinations are found\n */\nfunction validateDecoratorCombinations(\n mainSchema: z.ZodTypeAny,\n resourceIdentifier: string\n): void {\n const issues: string[] = [];\n\n try {\n const shape = getZodObjectShape(mainSchema);\n\n for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n const typedSchema = fieldSchema as z.ZodTypeAny;\n\n // Check: isSummaryField + isBackendOnly is invalid\n if (isSummaryField(typedSchema) && isBackendOnlyField(typedSchema)) {\n issues.push(\n `Field '${fieldName}' has both isSummaryField and isBackendOnly decorators. ` +\n `Backend-only fields cannot be included in summary responses.`\n );\n }\n\n // Check: isDiscriminator + excludeFromCreate is invalid\n if (isDiscriminatorField(typedSchema) && isExcludedFromCreate(typedSchema)) {\n issues.push(\n `Field '${fieldName}' has both isDiscriminator and excludeFromCreate decorators. ` +\n `Discriminator fields must be present in create requests to determine the variant type.`\n );\n }\n\n // Check: isDiscriminator + excludeFromUpdate is a warning (logged but not an error)\n // Discriminators are typically immutable, so this might be intentional\n }\n } catch {\n // Schema may not be an object, skip validation\n return;\n }\n\n if (issues.length > 0) {\n throw createConfigurationError(\n `Resource '${resourceIdentifier}' has invalid decorator combinations:\\n` +\n issues.map(issue => ` - ${issue}`).join('\\n')\n );\n }\n}\n\n// --------------------------------\n// Helper Types\n// --------------------------------\n\n/**\n * User notification definition for ResourceConfiguration builder.\n * Omits 'primaryScope' (auto-derived) and 'identifier' (auto-generated).\n *\n * Note: customNotificationRef is optional but REQUIRED when there are 2+ notifications\n * of the same target type in the same operation.\n *\n * Distributive omit: `UserNotificationDefinition` is a discriminated union (by\n * `channel`); a bare `Omit<Union, K>` collapses to only the COMMON keys and silently\n * drops every channel-specific field (the EMAIL variant's `recipientEmailField`, the\n * FRONT_END_SUCCESS variant's `celebration`/`nextStep`). Distributing over each union\n * member preserves those per-channel fields for config authoring.\n */\ntype DistributiveOmit<T, K extends PropertyKey> = T extends unknown ? Omit<T, K> : never;\ntype UserNotificationDefinitionWithoutPrimaryScopeAndIdentifier = DistributiveOmit<UserNotificationDefinition, 'primaryScope' | 'identifier'>;\ntype M2MNotificationDefinitionWithoutIdentifier = Omit<M2MNotificationDefinition, 'identifier'>;\n\n// --------------------------------\n// Helper Functions\n// --------------------------------\n\n/**\n * Transforms and categorizes resource relationships into parent/child/self buckets.\n *\n * ## Flat Categorization (No Separate Conditional Bucket)\n *\n * ALL relationships — including those with `discriminator` or `condition` — are placed\n * into the same three buckets (parentRelationships, childRelationships, selfRelationships).\n * Conditional relationships carry their filter inline on the relationship object itself,\n * so runtime consumers evaluate conditions when actual parent data is available:\n *\n * - **ResourceContextBackendService**: Checks discriminator/condition in `fetchChildResourcesWithPolicy`\n * against the parentResource BEFORE querying children.\n * - **ServicesRegistryHandler**: Uses `filterRelationshipsByParent()` at 4 points\n * (nested CREATE, READ, UPDATE, lifecycle DELETE) to filter active child relationships.\n * - **ContainerNested** (frontend): Evaluates discriminator/condition against parentData\n * with try-catch safety to prevent React tree crashes.\n *\n * Previously, a separate `inheritanceSchemaRelationships` bucket existed but was never\n * consumed at runtime, making the conditional system non-functional. That bucket has\n * been removed in favor of this flat, inline approach.\n *\n * ## M:N Relationship Decomposition\n *\n * Many-to-many relationships are decomposed into synthetic 1:N relationships:\n * - **Junction table**: Gets two parent relationships (one from each entity side),\n * with OPTIONAL_CONTEXT. These do NOT carry discriminator/condition (the junction\n * table itself doesn't need condition awareness — it's the entity sides that do).\n * - **Entity sides**: Each gets a child relationship to the junction table.\n * These DO carry the original `discriminator` and `condition` from the M:N declaration,\n * ensuring conditional M:N relationships work correctly.\n *\n * Important: this decomposition is an internal compilation step, not a second\n * developer-facing configuration surface. Developers declare one M:N\n * association with `jointResourceType`; the factory derives the synthetic\n * junction-facing edges needed by DTO builders, URL generation, and runtime\n * services.\n *\n * ## Relationship Direction Convention\n *\n * - `resourceType1` = parent, `resourceType2` = child\n * - `foreignKeyField` lives on the child (resourceType2) and points to the parent\n * - Example: USERS → USER_PROFILES with foreignKeyField: 'userId'\n * means userId is a field on USER_PROFILES pointing to USERS\n *\n * @param resourceRelationships - All relationships from the registry\n * @param resourceIdentifier - The resource type being processed\n * @returns Categorized relationships + set of available parent resource types\n */\nfunction transformResourceRelationships(\n resourceRelationships: ResourceRelationship[],\n resourceIdentifier: ResourceType\n): {\n processedResourceRelationships: ResourceConfiguration_ResourceRelationships;\n availableParentResourceTypes: Set<ResourceType>;\n} {\n // Categorize ALL relationships (including those with discriminator) into parent/child/self.\n // Relationships with a discriminator carry their filter inline on the relationship object itself,\n // so runtime consumers (ResourceContext, ContainerNested, services-registry-handler) evaluate\n // the discriminator at read/write time — no separate bucket is needed.\n //\n // Parent relationships are defined as: parent → child (resourceType1 → resourceType2)\n // When processing a resource, we look for relationships where we are the child (resourceType2)\n //\n // The foreignKeyField in these relationships specifies the FK field on the CHILD (resourceType2)\n // that points to the parent. This is the standard pattern for parent-child relationships.\n // Example: USERS → USER_PROFILES with foreignKeyField: 'userId'\n // - userId field is on USER_PROFILES, pointing to USERS\n // - USERS is the parent of USER_PROFILES\n //\n // NOTE: FK reference relationships (like TODOS → USERS with assignedToUserId)\n // where resourceType1 has a FK field pointing to resourceType2 are handled separately\n // at URL generation time, not here.\n // See: resources-config-operations.urls-builder.utils.ts:generateSyntheticFKParents()\n\n // F-8 fix: Filter out disabled relationships at the source.\n // All downstream consumers (ResourceContext, ServicesRegistryHandler, ContainerNested,\n // DTO builder) receive these categorized arrays, so filtering here prevents disabled\n // relationships from being processed anywhere in the pipeline.\n const activeRelationships = resourceRelationships.filter(rel => !rel.isDisabled);\n\n const isManyToMany = (rel: ResourceRelationship) =>\n rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n rel.jointResourceType;\n\n const processedResourceRelationships: ResourceConfiguration_ResourceRelationships = {\n // Filter out M:N relationships — they're peer relationships via a junction table,\n // transformed into synthetic 1:N relationships in the M:N processing section below.\n parentRelationships: activeRelationships.filter(rel =>\n rel.resourceType2 === resourceIdentifier &&\n rel.resourceType1 !== resourceIdentifier &&\n !isManyToMany(rel)\n ),\n childRelationships: activeRelationships.filter(rel =>\n rel.resourceType1 === resourceIdentifier &&\n rel.resourceType2 !== resourceIdentifier &&\n !isManyToMany(rel)\n ),\n // Self-referencing 1:N/1:1 relationships (tree/graph structures).\n // M:N self-refs are excluded — they're handled entirely through M:N decomposition\n // (synthetic junction-table relationships go into parent/child buckets).\n selfRelationships: activeRelationships.filter(rel =>\n rel.resourceType1 === resourceIdentifier && rel.resourceType2 === resourceIdentifier &&\n !isManyToMany(rel)\n ),\n };\n\n // ========================================\n // PROCESS MANY-TO-MANY JOINT RESOURCE RELATIONSHIPS\n // ========================================\n\n const compileSyntheticRelationship = (\n relationshipDeclaration: ResourceRelationshipDeclaration\n ): ResourceRelationship =>\n Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n\n /**\n * Build the synthetic **scope-anchored peer-under-scope** edge for an M:N\n * (scope-required reference search). It makes a target peer `T` addressable\n * UNDER the other peer `S` for SEARCH/LIST ONLY — e.g.\n * `/organizations/{organizationId}/users/search` — and tags it with the\n * junction `J` so the backend (a) scopes the `T` query via a junction subquery\n * (`T._id ∈ { J.targetFk : J.scopeFk = S_id }` — `T` holds no real FK column\n * for `S`) and (b) authorizes by `S`-membership instead of `T`'s own scope.\n * `OPTIONAL_CONTEXT` so the bare `/users/search` (global) route also survives;\n * `urlOperationScope` keeps this off READ/CREATE/UPDATE/DELETE routes (a\n * peer-under-scope path is a read-only access pattern).\n */\n const buildScopeAnchoredPeerEdge = (\n scopeType: ResourceType,\n targetType: ResourceType,\n junction: ResourceType,\n isDisabled: boolean,\n ): ResourceRelationship =>\n compileSyntheticRelationship({\n cardinality1: ResourceRelationshipCardinality.ONE, // one scope S\n cardinality2: ResourceRelationshipCardinality.MANY, // many targets T\n resourceType1: scopeType, // S — the URL parent (anchor scope)\n resourceType2: targetType, // T — the searched collection (current peer)\n nature: RelationshipNature.REFERENCE,\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n isPrimaryScope: false,\n isDisabled,\n allowCycle: false,\n scopeViaJunction: junction,\n urlOperationScope: [CoreResourceOperation.SEARCH, CoreResourceOperation.LIST],\n });\n\n // Find many-to-many relationships with joint resource types (from ALL active relationships,\n // including those with discriminators — a conditional M:N is still an M:N)\n const manyToManyRelationships = activeRelationships.filter(rel =>\n rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n rel.jointResourceType\n );\n\n // Additional relationships to add based on many-to-many joint resource logic\n const additionalRelationships: ResourceRelationship[] = [];\n\n manyToManyRelationships.forEach(m2mRel => {\n Resources_SharedUtils.assertSupportedManyToManySyntheticExpansion(m2mRel);\n const { resourceType1: entity1Type, resourceType2: entity2Type, jointResourceType, foreignKeyField } = m2mRel;\n\n if (resourceIdentifier === jointResourceType) {\n // ========================================\n // JUNCTION TABLE: Current resource IS the joint resource\n // ========================================\n // For many-to-many, the junction table can be accessed from BOTH sides:\n // - /organizations/{orgId}/organization-members\n // - /users/{userId}/organization-members\n // Both parents use OPTIONAL_CONTEXT so each generates independent URL paths\n //\n // NOTE: Junction table parent relationships do NOT carry discriminator/condition\n // from the original M:N. The junction table itself doesn't need condition awareness —\n // it's the entity→junction direction that carries conditions, because the entity\n // is the \"parent\" whose data is evaluated. The junction table looks UP to both\n // entities as parents, and parent traversal intentionally skips discriminator checks\n // (see fetchParentResourcesWithPolicy in ResourceContextBackendService).\n\n // Relationship: entity1 → joint resource (entity1 is a parent of junction table)\n const relationFromEntity1 = compileSyntheticRelationship({\n cardinality1: ResourceRelationshipCardinality.ONE, // One entity1\n cardinality2: ResourceRelationshipCardinality.MANY, // Many joint records\n resourceType1: entity1Type, // entity1 (e.g., ORGANIZATIONS)\n resourceType2: resourceIdentifier, // joint resource (e.g., ORGANIZATION_MEMBERS)\n jointResourceType,\n nature: m2mRel.resolvedSemantics.nature,\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n isPrimaryScope: false,\n isDisabled: m2mRel.isDisabled || false,\n allowCycle: false,\n // Preserve context policy and childOperations from original relationship\n contextPolicy: m2mRel.contextPolicy,\n read: m2mRel.read,\n childOperations: m2mRel.childOperations,\n foreignKeyField: m2mRel.foreignKeyField,\n });\n additionalRelationships.push(relationFromEntity1);\n\n // Relationship: entity2 → joint resource (entity2 is ALSO a parent of junction table)\n const relationFromEntity2 = compileSyntheticRelationship({\n cardinality1: ResourceRelationshipCardinality.ONE, // One entity2\n cardinality2: ResourceRelationshipCardinality.MANY, // Many joint records\n resourceType1: entity2Type, // entity2 (e.g., USERS)\n resourceType2: resourceIdentifier, // joint resource (e.g., ORGANIZATION_MEMBERS)\n jointResourceType,\n nature: m2mRel.resolvedSemantics.nature,\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT, // Both sides are optional\n isPrimaryScope: false,\n isDisabled: m2mRel.isDisabled || false,\n allowCycle: false,\n // Preserve context policy and childOperations from original relationship\n contextPolicy: m2mRel.contextPolicy,\n read: m2mRel.read,\n childOperations: m2mRel.childOperations,\n // For M:N self-referencing, foreignKeyField distinguishes source/target in junction table\n foreignKeyField: foreignKeyField,\n });\n additionalRelationships.push(relationFromEntity2);\n\n } else if (resourceIdentifier === entity1Type) {\n // ========================================\n // ENTITY1: Current resource is the first entity in the relationship\n // ========================================\n // Entity1 has junction table as child (for child relationships).\n // The synthetic entity→junction relationship DOES carry discriminator/condition\n // from the original M:N declaration (lines below). This ensures that conditional\n // M:N relationships (e.g., \"users have projects only when role=DEVELOPER\") are\n // correctly gated at runtime when looking DOWN from entity1 to the junction.\n\n if (!jointResourceType)\n throw createConfigurationError(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n\n const relationToJoint = compileSyntheticRelationship({\n cardinality1: ResourceRelationshipCardinality.ONE, // One entity\n cardinality2: ResourceRelationshipCardinality.MANY, // Many joint records\n resourceType1: resourceIdentifier, // current entity\n resourceType2: jointResourceType, // joint resource\n jointResourceType,\n nature: m2mRel.resolvedSemantics.nature,\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n isPrimaryScope: false,\n isDisabled: m2mRel.isDisabled || false,\n allowCycle: m2mRel.allowCycle || false,\n contextPolicy: m2mRel.contextPolicy,\n read: m2mRel.read,\n childOperations: m2mRel.childOperations,\n foreignKeyField: m2mRel.foreignKeyField,\n discriminator: m2mRel.discriminator,\n condition: m2mRel.condition,\n display: m2mRel.display,\n });\n additionalRelationships.push(relationToJoint);\n\n // Scope-anchored read edge: this resource (entity1, the target T) becomes\n // addressable under entity2 (the scope S) for SEARCH/LIST via the junction.\n additionalRelationships.push(\n buildScopeAnchoredPeerEdge(entity2Type, resourceIdentifier, jointResourceType, m2mRel.isDisabled || false),\n );\n\n } else if (resourceIdentifier === entity2Type) {\n // ========================================\n // ENTITY2: Current resource is the second entity in the relationship\n // ========================================\n // Entity2 also has junction table as child (for child relationships).\n // Same as Entity1: carries discriminator/condition from the M:N declaration\n // to enable conditional gating when looking DOWN from entity2 to the junction.\n\n if (!jointResourceType)\n throw createConfigurationError(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n\n const relationToJoint = compileSyntheticRelationship({\n cardinality1: ResourceRelationshipCardinality.ONE, // One entity\n cardinality2: ResourceRelationshipCardinality.MANY, // Many joint records\n resourceType1: resourceIdentifier, // current entity\n resourceType2: jointResourceType, // joint resource\n jointResourceType,\n nature: m2mRel.resolvedSemantics.nature,\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n isPrimaryScope: false,\n isDisabled: m2mRel.isDisabled || false,\n allowCycle: m2mRel.allowCycle || false,\n contextPolicy: m2mRel.contextPolicy,\n read: m2mRel.read,\n childOperations: m2mRel.childOperations,\n foreignKeyField: foreignKeyField,\n discriminator: m2mRel.discriminator,\n condition: m2mRel.condition,\n display: m2mRel.display,\n });\n additionalRelationships.push(relationToJoint);\n\n // Scope-anchored read edge: this resource (entity2, the target T) becomes\n // addressable under entity1 (the scope S) for SEARCH/LIST via the junction.\n additionalRelationships.push(\n buildScopeAnchoredPeerEdge(entity1Type, resourceIdentifier, jointResourceType, m2mRel.isDisabled || false),\n );\n }\n });\n\n // Add the additional relationships to the appropriate categories\n additionalRelationships.forEach(rel => {\n if (rel.resourceType2 === resourceIdentifier && rel.resourceType1 !== resourceIdentifier) {\n processedResourceRelationships.parentRelationships.push(rel);\n } else if (rel.resourceType1 === resourceIdentifier && rel.resourceType2 !== resourceIdentifier) {\n processedResourceRelationships.childRelationships.push(rel);\n } else if (rel.resourceType1 === resourceIdentifier && rel.resourceType2 === resourceIdentifier) {\n processedResourceRelationships.selfRelationships.push(rel);\n }\n });\n\n // Create set of available parent resource types for validation.\n // Includes selfRelationships because a self-ref acts as its own parent (tree roots).\n const availableParentResourceTypes = new Set([\n ...processedResourceRelationships.parentRelationships.map(rel => rel.resourceType1),\n ...processedResourceRelationships.selfRelationships.map(rel => rel.resourceType1),\n ]);\n\n return {\n processedResourceRelationships,\n availableParentResourceTypes\n };\n}\n\n/**\n * Processes parent resource access scope strategy overrides for an operation.\n *\n * Creates a shallow copy of the relationship buckets with overridden `accessScopeStrategy`\n * values for specific parent resource types. This allows per-operation customization of\n * how parent resources are resolved in URL paths (e.g., making an optional parent\n * mandatory for a specific operation).\n *\n * The returned object has exactly three fields: `parentRelationships`, `childRelationships`,\n * `selfRelationships`. There is no `inheritanceSchemaRelationships` field — that structure\n * was removed as part of the relationship condition refactor.\n *\n * @param resourceRelationships - The base relationship buckets (from transformResourceRelationships)\n * @param availableParentResourceTypes - Set of valid parent resource types for validation\n * @param parentResourceAccessScopeStrategyOverrides - Overrides to apply\n * @param operationIdentifier - The operation name (for error messages)\n * @returns A new ResourceConfiguration_ResourceRelationships with overrides applied\n */\nfunction processParentResourceAccessScopeStrategyOverrides(\n resourceRelationships: ResourceConfiguration_ResourceRelationships,\n availableParentResourceTypes: Set<ResourceType>,\n parentResourceAccessScopeStrategyOverrides: { resourceType: ResourceType, accessScopeStrategy: ResourceRelationshipAccessScopeStrategy }[],\n operationIdentifier: string\n): ResourceConfiguration_ResourceRelationships {\n if (!parentResourceAccessScopeStrategyOverrides || parentResourceAccessScopeStrategyOverrides.length === 0) {\n return resourceRelationships;\n }\n\n // Validate that all override resources exist in parent relationships\n for (const override of parentResourceAccessScopeStrategyOverrides) {\n if (!availableParentResourceTypes.has(override.resourceType)) {\n throw createConfigurationError(`Operation '${operationIdentifier}' has access scope strategy override for parent resource '${override.resourceType}' but it's not available in parent relationships`);\n }\n }\n\n // Create a map for quick lookup of overrides\n const overrideMap = new Map<ResourceType, ResourceRelationshipAccessScopeStrategy>();\n parentResourceAccessScopeStrategyOverrides.forEach(override => {\n overrideMap.set(override.resourceType, override.accessScopeStrategy);\n });\n\n const applyOverride = (rel: ResourceRelationship): ResourceRelationship => {\n const overrideStrategy = overrideMap.get(rel.resourceType1);\n return overrideStrategy !== undefined ? { ...rel, accessScopeStrategy: overrideStrategy } : rel;\n };\n\n const updatedResourceRelationships: ResourceConfiguration_ResourceRelationships = {\n parentRelationships: resourceRelationships.parentRelationships.map(applyOverride),\n childRelationships: [...resourceRelationships.childRelationships],\n // Self-refs act as their own parent — scope strategy overrides must apply.\n selfRelationships: resourceRelationships.selfRelationships.map(applyOverride),\n };\n\n return updatedResourceRelationships;\n}\n\n/**\n * Processes user notifications by adding primaryScope and auto-generating identifiers\n * Format: ${resourceIdentifier}_${operationIdentifier}_${target}_${customNotificationRef?}_${userRoles.join(\"_\")}_${level}\n *\n * Validates that when there are 2+ notifications with the same target in the same operation,\n * each one must have a unique customNotificationRef to distinguish them.\n */\nfunction processUserNotifications(\n userNotifications: UserNotificationDefinitionWithoutPrimaryScopeAndIdentifier[],\n resourceIdentifier: ResourceType,\n operationIdentifier: string,\n resourcePrimaryScope: ResourcePrimaryScope\n): UserNotificationDefinition[] {\n\n // ========================================\n // VALIDATE DUPLICATE TARGET NOTIFICATIONS\n // ========================================\n\n // Group notifications by target+channel to find duplicates\n const notificationsByTargetChannel = new Map<string, UserNotificationDefinitionWithoutPrimaryScopeAndIdentifier[]>();\n userNotifications.forEach(n => {\n const key = `${n.target}_${n.channel}`;\n if (!notificationsByTargetChannel.has(key)) {\n notificationsByTargetChannel.set(key, []);\n }\n notificationsByTargetChannel.get(key)!.push(n);\n });\n\n // Validate customNotificationRef for groups with 2+ notifications\n for (const [targetChannel, notifications] of notificationsByTargetChannel.entries()) {\n if (notifications.length >= 2) {\n // Check that all have customNotificationRef\n const missingRefs = notifications.filter(n => !n.customNotificationRef);\n if (missingRefs.length > 0) {\n throw createConfigurationError(\n `Operation '${resourceIdentifier}_${operationIdentifier}' has ${notifications.length} notifications with target_channel '${targetChannel}'. ` +\n `When there are 2+ notifications with the same target, each must have a unique 'customNotificationRef' to distinguish them. ` +\n `${missingRefs.length} notification(s) are missing customNotificationRef.`\n );\n }\n\n // Check that all customNotificationRefs are unique\n const refs = notifications.map(n => n.customNotificationRef);\n const uniqueRefs = new Set(refs);\n if (uniqueRefs.size !== refs.length) {\n throw createConfigurationError(\n `Operation '${resourceIdentifier}_${operationIdentifier}' has duplicate customNotificationRef values for target_channel '${targetChannel}'. ` +\n `Each notification with the same target must have a unique customNotificationRef. ` +\n `Found refs: [${refs.join(', ')}]`\n );\n }\n }\n }\n\n // ========================================\n // GENERATE IDENTIFIERS\n // ========================================\n\n return userNotifications.map(notification => {\n // Auto-generate identifier: ${resourceIdentifier}_${current_operation}_${target}_${customNotificationRef?}_${userRoles.join(\"_\")}_${level}\n const identifierParts = [\n resourceIdentifier,\n operationIdentifier,\n notification.target\n ];\n\n // Add customNotificationRef if present (for disambiguation)\n if (notification.customNotificationRef) {\n identifierParts.push(notification.customNotificationRef);\n }\n\n // Add userRoles if present\n if (notification.userRoles && notification.userRoles.length > 0) {\n identifierParts.push(notification.userRoles.join(\"_\"));\n }\n\n // Add level if present\n if (notification.level) {\n identifierParts.push(notification.level);\n }\n\n const autoGeneratedIdentifier = identifierParts.join(\"_\");\n\n return {\n ...notification,\n identifier: autoGeneratedIdentifier,\n primaryScope: resourcePrimaryScope\n };\n });\n}\n\n/**\n * Processes M2M notifications by auto-generating identifiers\n * Format: ${resourceIdentifier}_${operationIdentifier}_${channel}\n */\nfunction processM2MNotifications(\n m2mNotifications: M2MNotificationDefinitionWithoutIdentifier[],\n resourceIdentifier: ResourceType,\n operationIdentifier: string\n): M2MNotificationDefinitionWithoutIdentifier[] {\n return m2mNotifications.map(notification => {\n // Auto-generate identifier: ${resourceIdentifier}_${current_operation}_${channel}\n const autoGeneratedIdentifier = [\n resourceIdentifier,\n operationIdentifier,\n notification.channel\n ].join(\"_\");\n\n return {\n ...notification,\n identifier: autoGeneratedIdentifier\n };\n });\n}\n\n// --------------------------------\n// Resources Pagination Response\n// --------------------------------\n\n\nfunction createResourcePaginatedResponseSchema<T extends z.ZodTypeAny>(params: {\n dataSchema: T;\n validateArrayConstraints?: boolean;\n maxResultsPerPageLimit?: number;\n}): z.ZodType<ResourcePaginatedResponseResultSchema<T>> {\n\n const {\n dataSchema,\n validateArrayConstraints = true,\n maxResultsPerPageLimit = 50\n } = params;\n\n // Comprehensive parameter validation\n if (!dataSchema) {\n throw createConfigurationError('Data schema is required and cannot be null or undefined');\n }\n\n // Use duck typing instead of instanceof to avoid version conflicts\n if (typeof dataSchema !== 'object' ||\n typeof dataSchema.parse !== 'function' ||\n typeof dataSchema.safeParse !== 'function' ||\n !dataSchema._def) {\n throw createConfigurationError(`Data schema must be a valid Zod schema type. Got: ${typeof dataSchema}, constructor: ${dataSchema?.constructor?.name}`);\n }\n\n if (validateArrayConstraints) {\n if (typeof maxResultsPerPageLimit !== 'number' || maxResultsPerPageLimit < 0) {\n throw createConfigurationError('Max results per page limit must be a non-negative number');\n }\n }\n\n // Create strongly typed array schema with optional constraints\n const createDataArraySchema = (schema: T) => {\n let arraySchema = z.array(schema);\n\n if (validateArrayConstraints) {\n if (maxResultsPerPageLimit > 0) {\n arraySchema = arraySchema.max(maxResultsPerPageLimit, `Data array cannot contain more than ${maxResultsPerPageLimit} items`);\n }\n }\n\n return arraySchema;\n };\n\n // Runtime validation with comprehensive error messages\n const validatePaginatedResponse = (input: any): input is ResourcePaginatedResponseResultSchema<T> => {\n // Validate root structure\n if (!input || typeof input !== 'object') {\n throw createValidationError('Paginated response must be an object');\n }\n\n // Validate data field existence\n if (!('data' in input)) {\n throw createValidationError('Paginated response must have a \"data\" field');\n }\n\n // Validate data is an array\n if (!Array.isArray(input.data)) {\n throw createValidationError('Data field must be an array');\n }\n\n // Validate array constraints if enabled\n if (validateArrayConstraints) {\n if (input.data.length > maxResultsPerPageLimit) {\n throw createValidationError(`Data array cannot contain more than ${maxResultsPerPageLimit} items, got ${input.data.length}`);\n }\n }\n\n // Validate pagination field existence\n if (!('pagination' in input)) {\n throw createValidationError('Paginated response must have a \"pagination\" field');\n }\n\n // Validate pagination structure\n if (!input.pagination || typeof input.pagination !== 'object') {\n throw createValidationError('Pagination field must be an object');\n }\n\n // Validate required pagination fields\n const requiredPaginationFields = ['page', 'limit', 'total', 'totalPages'];\n for (const field of requiredPaginationFields) {\n if (!(field in input.pagination)) {\n throw createValidationError(`Pagination must have a \"${field}\" field`);\n }\n\n if (typeof input.pagination[field] !== 'number') {\n throw createValidationError(`Pagination \"${field}\" must be a number`);\n }\n\n if (input.pagination[field] < 0) {\n throw createValidationError(`Pagination \"${field}\" must be non-negative`);\n }\n }\n\n // Validate pagination logic\n if (input.pagination.page > input.pagination.totalPages && input.pagination.totalPages > 0) {\n throw createValidationError('Current page cannot exceed total pages');\n }\n\n if (input.pagination.limit <= 0) {\n throw createValidationError('Pagination limit must be positive');\n }\n\n return true;\n };\n\n // Create the result schema with comprehensive validation\n const resultSchema = z.object({\n data: createDataArraySchema(dataSchema),\n // Bounded by the SAME ceiling as the data array above. `limit` reports the page size actually\n // served, so a stricter bound here rejects pages this very schema just declared valid.\n pagination: createPaginationResponseMetadataSchema(maxResultsPerPageLimit)\n }).refine(validatePaginatedResponse, {\n message: \"Invalid paginated response structure\"\n });\n\n return resultSchema as z.ZodType<ResourcePaginatedResponseResultSchema<T>>;\n}\n\n\n\n// --------------------------------\n// Resource Search Query Request\n// --------------------------------\n\n/**\n * The ONE authority for the `{ pagination, sorting, filters }` argument envelope every\n * collection-shaped operation accepts.\n *\n * Exported rather than factory-private because a second surface needs the identical shape: the MCP\n * tool adapter advertises this envelope for collection tools whose `requestDto` is empty. A LIST\n * operation keeps `requestDto: z.object({})` — its filters travel in the QUERY STRING over HTTP, so\n * giving it a request BODY would misdescribe the REST contract and the generated OpenAPI — yet the\n * MCP dispatch normalises the very same envelope for it. Advertising had to be fixed without\n * touching the DTO, and that means this builder is reachable from both places.\n *\n * Deriving the shape a second time in the adapter was the rejected alternative: a filter allow-list\n * that drifts between the surface that ADVERTISES it and the surface that ENFORCES it is precisely\n * the defect class this envelope already caused once.\n */\nexport function createResourceSearchQueryRequestSchema<\n TFilterFields extends Record<string, PrimitiveZodType> | undefined,\n TSortFields extends readonly string[] | undefined,\n>(params: {\n filterFields: TFilterFields;\n allowedSortFields: TSortFields;\n pagination: boolean;\n /**\n * The operation's declared page ceiling, mirrored onto the REQUEST side.\n *\n * Without it the request DTO refuses any `pagination.limit` above a hard-coded 100 while the\n * repository and the response DTO both honour the declared value — so an operation declaring 200\n * advertises a limit it answers **400** to. Found 2026-08-12 by an e2e probe asking `users SEARCH`\n * (declared 200) for 120: `pagination.limit: Too big: expected number to be <=100`.\n *\n * Defaults to 100 — the bound this schema has always enforced — so an un-migrated caller keeps\n * exactly its current contract.\n */\n maxPaginatedResultPerPageLimit?: number;\n}): ResourceSearchQueryRequestResult<TFilterFields, TSortFields> {\n\n const { filterFields, allowedSortFields = [], pagination = true, maxPaginatedResultPerPageLimit } = params;\n\n // Validate input parameters\n if (filterFields !== undefined && typeof filterFields !== 'object') {\n throw createConfigurationError('Filter fields must be an object');\n }\n\n if (allowedSortFields && !Array.isArray(allowedSortFields)) {\n throw createConfigurationError('Allowed sort fields must be an array');\n }\n\n if (allowedSortFields && allowedSortFields.length > 0 && !allowedSortFields.every(field => typeof field === 'string' && field.length > 0)) {\n throw createConfigurationError('All sort fields must be non-empty strings');\n }\n\n // Strongly typed filter schema creation\n const createFilterSchema = <T extends Record<string, PrimitiveZodType>>(fields: T) => {\n const processedFields: Record<string, z.ZodOptional<any>> = {};\n\n Object.entries(fields).forEach(([key, schema]) => {\n // Type-safe schema processing based on schema type\n if (schema instanceof z.ZodDate) {\n processedFields[key] = Resources_Filter_DateRangeSchema.optional();\n } else if (schema instanceof z.ZodString) {\n processedFields[key] = (schema as z.ZodString).optional();\n } else if (schema instanceof z.ZodNumber) {\n processedFields[key] = (schema as z.ZodNumber).optional();\n } else if (schema instanceof z.ZodBoolean) {\n processedFields[key] = (schema as z.ZodBoolean).optional();\n } else if (schema instanceof z.ZodEnum) {\n processedFields[key] = (schema as z.ZodEnum<any>).optional();\n } else {\n // Fallback for other primitive types\n processedFields[key] = (schema as z.ZodTypeAny).optional();\n }\n });\n\n return Resources_Filter_BaseSchema.extend(processedFields);\n };\n\n // Strongly typed sorting schema creation\n const createSortingSchema = (fields: readonly string[]) => {\n const sortingFields: Record<string, z.ZodOptional<z.ZodObject<any>>> = {};\n\n fields.forEach(field => {\n sortingFields[field] = z.object({\n field: z.literal(field),\n order: z.enum(SortOrder).default(SortOrder.ASC),\n priority: z.number().min(0).default(0)\n }).optional();\n });\n\n return z.object(sortingFields).optional();\n };\n\n\n // Build the schema dynamically based on parameters\n const schemaConfig: any = {};\n\n // Add pagination if enabled.\n //\n // Built from the operation's ceiling rather than the shared default-bounded constant, so the limit\n // a caller may REQUEST, the limit the repository will SERVE and the limit the response DTO ACCEPTS\n // are one number. They were three, and the request side was the strictest — which is why a\n // declared ceiling above 100 was unreachable over HTTP no matter what the other two allowed.\n if (pagination) {\n schemaConfig.pagination = createPaginationRequestSchema(maxPaginatedResultPerPageLimit).optional();\n }\n\n // Add sorting if allowed fields are provided\n if (allowedSortFields && allowedSortFields.length > 0) {\n schemaConfig.sorting = createSortingSchema(allowedSortFields);\n }\n\n // Add filtering based on filter fields\n if (filterFields !== undefined && Object.keys(filterFields).length > 0) {\n schemaConfig.filters = createFilterSchema(filterFields).optional();\n } else {\n schemaConfig.filters = Resources_Filter_BaseSchema.optional();\n }\n\n // Create the final schema with validation\n const resultSchema = z.object(schemaConfig);\n\n return resultSchema as ResourceSearchQueryRequestResult<TFilterFields, TSortFields>;\n}\n\n\n\n\n\n// Helper function to determine HTTP verb based on operation\nfunction getDefaultHttpVerbForOperation(operation: string): HttpMethod {\n switch (operation) {\n case CoreResourceOperation.READ:\n case CoreResourceOperation.LIST:\n case CoreResourceOperation.SEARCH:\n case CoreResourceOperation.COUNT:\n return HttpMethod.GET;\n case CoreResourceOperation.CREATE:\n case CoreResourceOperation.CREATE_MANY:\n return HttpMethod.POST;\n case CoreResourceOperation.UPDATE:\n case CoreResourceOperation.UPDATE_MANY:\n return HttpMethod.PUT;\n case CoreResourceOperation.DELETE:\n case CoreResourceOperation.DELETE_MANY:\n return HttpMethod.DELETE;\n default:\n return HttpMethod.POST; // Default for unknown operations\n }\n}\n\n/**\n * Determines if an operation variant should be marked as the default operation within its variantType group\n * Handles the complex logic for single vs multiple variants and explicit defaults\n *\n * Rules after validation:\n * 1. If only one variant exists in the group, it becomes the group default UNLESS the author\n * explicitly opted it out with `isDefault: false`. An omitted/`undefined` `isDefault` still\n * becomes the group default — only an explicit `false` is honored.\n *\n * Rationale: a sole `isDefault: false` variant is a real authoring signal that this transport\n * has NO default for the operation. Example: `users.list` declares an `INTERNAL_CALL` default\n * plus a single keyed `API_CALL` \"admin\" variant marked `isDefault: false` — there is no public\n * default URL listing, only the admin-keyed one. The prior behavior force-defaulted such a\n * variant, which (a) contradicted author intent and (b) produced two `isOperationDefault === true`\n * operations for one operation identifier across transport groups (one per group) — a latent\n * hazard for any consumer that filters defaults across transports (e.g. a set-filter that matches\n * >1 and throws). Honoring the explicit `false` keeps each transport group with at most one\n * default and makes the variant resolvable only via its keyed path resolver, which is the intent.\n * See `.claude/plans/internal-call-operation-path-resolution.md` (D6 + RESOLUTION).\n * 2. If multiple variants exist in the group, validation requires exactly one `isDefault=true`.\n * 3. Fallback selection is kept for direct/test-only callers that bypass factory validation,\n * but authored multi-variant groups must never rely on array order.\n */\nfunction determineOperationVariantDefault(\n variantsOfSameType: ResourceConfiguration_OperationVariant_BuilderParameters<any>[],\n currentVariant: ResourceConfiguration_OperationVariant_BuilderParameters<any>\n): boolean {\n // Rule 1: A single variant of this type is the group default UNLESS the author\n // explicitly opted out with `isDefault: false`. An omitted/`undefined` `isDefault`\n // still becomes the default — only an explicit `false` is honored (see JSDoc above).\n if (variantsOfSameType.length === 1) {\n return currentVariant.isDefault !== false;\n }\n\n // Rule 2: Find explicit isDefault=true within this variant type group\n const explicitDefaultVariant = variantsOfSameType.find(variant =>\n variant.isDefault === true\n );\n\n // If we found an explicit default, check if current variant is it\n if (explicitDefaultVariant) {\n return currentVariant === explicitDefaultVariant;\n }\n\n // Rule 3: No explicit isDefault=true found, use first variant that doesn't have isDefault=false\n const firstNonFalseVariant = variantsOfSameType.find(variant =>\n variant.isDefault !== false\n );\n\n if (firstNonFalseVariant) {\n return currentVariant === firstNonFalseVariant;\n }\n\n // Fallback: if all variants have isDefault=false, first one becomes default anyway\n return currentVariant === variantsOfSameType[0];\n}\n\nconst RESERVED_OPERATION_VARIANT_KEYS = new Set([\n 'isdefault',\n 'novariantkey',\n]);\nconst AUTO_OPERATION_VARIANT_KEYS = new Set([\n OPERATION_VARIANT_KEY.SUMMARY,\n OPERATION_VARIANT_KEY.CONTEXT,\n]);\n\nfunction isDataModeVariantKeyAllowedForOperation(\n operation: string,\n variant: ResourceConfiguration_OperationVariant_BuilderParameters<any>,\n): boolean {\n const effectiveOperation = variant.resourceOperationLike ?? operation;\n return effectiveOperation === CoreResourceOperation.READ\n || effectiveOperation === CoreResourceOperation.LIST\n || effectiveOperation === CoreResourceOperation.SEARCH;\n}\n\n// --------------------------------\n// Resources Shared Configuration\n// --------------------------------\n\n/**\n * Creates a resource configuration from builder parameters.\n * NOTE: TDatabaseSchema has been removed. Backend-only fields are now marked with\n * the isBackendOnly decorator in mainSchema and are stripped at the service layer.\n */\nexport function createResourceConfiguration_Initialization<\n TCustomOperationEnum extends EnumLikeType | undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined,\n TMainSchema extends z.ZodTypeAny,\n>(params: ResourceConfiguration_BuilderParameters<\n TCustomOperationEnum, TCoreOperationEnum, TMainSchema\n>): ResourceConfiguration<TCustomOperationEnum, TCoreOperationEnum, TMainSchema> {\n\n const {\n mainSchema,\n resourceIdentifier,\n resourceFieldIdentifier,\n resourceRelationships,\n inheritenceSchemaDefinition,\n isSystemResource = false,\n // Defaulted TRUE — the safe direction. A resource that never considered whether its primary key\n // names the caller keeps the identity-coherence refusal; only a deliberate `false` relaxes it.\n primaryKeyIdentifiesInitiator = true,\n // Fail-closed default: a resource that does not author `systemAccessPolicy`\n // gets an explicit all-verbs-FORBIDDEN policy, so the resolved config is\n // self-documenting and every system-context primitive\n // (`readAsSystem`/`listAsSystem` and the trusted\n // `createAsSystem`/`updateAsSystem`/`updateManyAsSystem` writes) rejects it\n // by default.\n systemAccessPolicy = {\n read: ResourceSystemAccessMode.FORBIDDEN,\n list: ResourceSystemAccessMode.FORBIDDEN,\n create: ResourceSystemAccessMode.FORBIDDEN,\n update: ResourceSystemAccessMode.FORBIDDEN,\n updateMany: ResourceSystemAccessMode.FORBIDDEN,\n },\n isAnonymizable = false,\n transpositionPolicy,\n retentionPolicy,\n dataSubjectPolicy,\n portabilityPolicy,\n persistenceAdapter,\n persistenceAdapterIsolation,\n httpApiBinding,\n introspectionBinding,\n coreOperations,\n customOperation,\n operationsConfiguration,\n } = params;\n\n /**\n * HTTP_API ↔ binding coherence — enforced at AUTHORING, both directions, because each half\n * alone is a contradiction the backend could only discover later and worse:\n * - `HTTP_API` without a binding is a resource whose rows live \"somewhere over HTTP\" with no\n * target, key, identity or erasure story — nothing downstream can repair that;\n * - a binding on a platform-backed resource is a declaration nothing will ever read, i.e. a\n * config that LOOKS externally bound and silently is not.\n * The binding's CONTENT is validated here too (Zod parse) so a malformed declaration names its\n * defect at the factory, not at boot. (ETL plan Step 3; registration-time checks that need the\n * RESOLVED adapter or the live registry — scope expressibility, retention/anonymizable/scope-root\n * refusals — live in the backend registry validation, which structurally cannot run here.)\n */\n if (persistenceAdapter === PersistenceAdapter.HTTP_API && httpApiBinding === undefined) {\n throw createConfigurationError(\n `[${resourceIdentifier}] persistenceAdapter 'http-api' requires the companion 'httpApiBinding' declaration (provider, dialect, key fields, identity, tenancy, erasure).`\n );\n }\n if (persistenceAdapter === PersistenceAdapter.INTROSPECTION && introspectionBinding === undefined) {\n throw createConfigurationError(\n `[${resourceIdentifier}] persistenceAdapter 'introspection' requires an 'introspectionBinding' naming the companion behavior whose output becomes this resource's rows.`\n );\n }\n if (introspectionBinding !== undefined && persistenceAdapter !== PersistenceAdapter.INTROSPECTION) {\n throw createConfigurationError(\n `[${resourceIdentifier}] 'introspectionBinding' is declared but persistenceAdapter is '${String(persistenceAdapter ?? 'undeclared (application default)')}' — a binding on a stored resource would never be read. Declare persistenceAdapter: 'introspection' or remove the binding.`\n );\n }\n if (httpApiBinding !== undefined && persistenceAdapter !== PersistenceAdapter.HTTP_API) {\n throw createConfigurationError(\n `[${resourceIdentifier}] 'httpApiBinding' is declared but persistenceAdapter is '${String(persistenceAdapter ?? 'undeclared (application default)')}' — a binding on a platform-backed resource would never be read. Declare persistenceAdapter: 'http-api' or remove the binding.`\n );\n }\n /**\n * `persistenceAdapterIsolation` alongside `HTTP_API` is REFUSED, because the claim it makes is\n * one the adapter has already settled — so honouring it would be honouring nothing.\n *\n * The declaration exists to buy a resource admission past the one-adapter rule when it disagrees\n * with the application default: its author asserts the resource takes part in no cross-adapter\n * atomic write, and the resources registry admits it and logs the admitted set. An `HTTP_API`\n * resource is admitted by that same rule WITHOUT any such assertion, on the adapter's own nature —\n * it is not a second platform store, it owns no transactions, and it cannot be an application\n * default. The registry's exemption is therefore ordered BEFORE the isolation branch and returns\n * first, so on an `HTTP_API` resource the isolation claim is never read.\n *\n * Silently ignoring it is the outcome worth preventing. An author who writes the field believes\n * they have bought something, and every later reader believes the resource's admission depends on\n * it — so a future change to the isolation door would look like it affected this resource when it\n * could not. A field whose absence and presence are indistinguishable is worse than a rejected\n * one; this is the same reasoning as the sibling refusal directly above, where a binding on a\n * platform-backed resource is refused precisely because nothing would ever read it.\n */\n if (persistenceAdapter === PersistenceAdapter.HTTP_API && persistenceAdapterIsolation !== undefined) {\n throw createConfigurationError(\n `[${resourceIdentifier}] 'persistenceAdapterIsolation' is declared alongside persistenceAdapter 'http-api', where it is never read — an http-api resource is admitted past the one-adapter rule on the adapter's own nature, not on an isolation claim. Remove the isolation declaration.`\n );\n }\n // The RESOLVED binding, not the authored one. An author writes the schema's INPUT shape\n // (`HttpApiResourceBindingAuthored`), so defaults like `verifyMetadataAtBoot`, `connection` and\n // `remoteCallSemantics` may be absent from what they typed; every consumer reads the parsed shape\n // and is entitled to find them. The parse result used to be DISCARDED — harmless only because\n // authoring demanded every field, which is precisely the burden the authored shape removes.\n const resolvedHttpApiBinding = httpApiBinding === undefined ? undefined : (() => {\n const bindingParse = HttpApiResourceBindingSchema.safeParse(httpApiBinding);\n if (!bindingParse.success) {\n throw createConfigurationError(\n `[${resourceIdentifier}] invalid httpApiBinding declaration: ${bindingParse.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`).join('; ')}`\n );\n }\n try {\n assertHttpApiBindingDialectCoherence(bindingParse.data);\n } catch (error) {\n throw createConfigurationError(\n `[${resourceIdentifier}] invalid httpApiBinding declaration: ${error instanceof Error ? error.message : String(error)}`\n );\n }\n return bindingParse.data;\n })();\n\n /**\n * `externalDataPipeline` — the inbound ETL pipeline on an ordinary LOCAL resource (partial-resource\n * coverage v3; PR-3/PR-4). Validated at AUTHORING like `httpApiBinding` above: shape (Zod),\n * schema-independent coherence (`assertExternalDataPipelineDeclarationCoherence` — S1 tenancy\n * confinement, unique mapping targets, coercion×dialect), the source binding's own dialect\n * coherence, and every mainSchema-dependent rule:\n *\n * - the pipeline is FORBIDDEN on an HTTP_API-adapter resource (a virtual resource IS the\n * remote side — chaining a pipeline onto read-through would re-create the composite v1\n * rejected);\n * - `remoteKeyLocalField` exists, is a STRING, and is declared `.isBusinessKey()` +\n * `excludeFromCreate` + `excludeFromUpdate` — SYNC's idempotent upsert keys on it and no\n * caller may mint or move it (boot-CHECKED, not factory-mutated: the app author sees the\n * truth in their own schema file);\n * - every mapped local field exists and is `excludeFromCreate`/`excludeFromUpdate`\n * (remote-authoritative — D-P5), and a non-`required` REMOTE_FIELD target must ACCEPT\n * ABSENCE (optional/nullable/default wrapper), or an absent remote value would have nowhere\n * honest to land (v3.1 §3);\n * - `ISO_STRING_TO_DATE` targets must be date fields;\n * - `population: CLOSED` refuses declared caller CREATE operations (D-P8) — INCLUDING a custom\n * operation that is create-shaped through `resourceOperationLike`. Enumerating only\n * `coreOperations` was the earlier, narrower form and it was a real hole: a custom operation\n * is exactly where an author expresses \"mint a row my own way\", so it is the likeliest way\n * into a CLOSED population, not an exotic one.\n */\n const externalDataPipeline = params.externalDataPipeline === undefined ? undefined : (() => {\n const refuse = (message: string): never => {\n throw createConfigurationError(`[${resourceIdentifier}] invalid externalDataPipeline declaration: ${message}`);\n };\n if (persistenceAdapter === PersistenceAdapter.HTTP_API) {\n refuse(\"an HTTP_API-adapter (virtual) resource cannot ALSO declare a pipeline — it IS the remote side; declare the pipeline on the LOCAL destination resource instead.\");\n }\n const declarationParse = ExternalDataPipelineDeclarationSchema.safeParse(params.externalDataPipeline);\n if (!declarationParse.success) {\n refuse(declarationParse.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`).join('; '));\n }\n const declaration = declarationParse.data!;\n try {\n assertExternalDataPipelineDeclarationCoherence(declaration);\n assertHttpApiBindingDialectCoherence(declaration.binding);\n } catch (error) {\n refuse(error instanceof Error ? error.message : String(error));\n }\n\n const shape = getZodObjectShape(mainSchema);\n const requireMappedTarget = (fieldName: string, context: string): z.ZodTypeAny => {\n const fieldSchema = shape[fieldName];\n if (!fieldSchema) refuse(`${context}: local field '${fieldName}' does not exist on mainSchema.`);\n if (!isExcludedFromCreate(fieldSchema!) || !isExcludedFromUpdate(fieldSchema!)) {\n refuse(\n `${context}: local field '${fieldName}' must be declared .excludeFromCreate() and .excludeFromUpdate() — it is REMOTE-AUTHORITATIVE (written only by the pipeline), and the exclusion is also what renders it read-only end to end (DTO → UI).`\n );\n }\n return fieldSchema!;\n };\n\n const keyFieldSchema = requireMappedTarget(declaration.remoteKeyLocalField, 'remoteKeyLocalField');\n if (!(unwrapSchema(keyFieldSchema) instanceof z.ZodString)) {\n refuse(`remoteKeyLocalField: '${declaration.remoteKeyLocalField}' must be a STRING field — it stores the synthesized remote id.`);\n }\n if (!isBusinessKeyField(keyFieldSchema)) {\n refuse(\n `remoteKeyLocalField: '${declaration.remoteKeyLocalField}' must be declared .isBusinessKey() — SYNC's idempotent upsert keys on it, and the business-key declaration is what makes the load MERGE instead of duplicate.`\n );\n }\n // ...and `.isUnique()` ON TOP, which is NOT redundant with the line above: the SQL schema\n // planner derives a UNIQUE constraint from `.isUnique()` and never from `.isBusinessKey()`.\n // Without it the merge contract is upheld only by our own read-then-write, so two concurrent\n // runs of one pipeline can leave TWO rows for one remote row — the exact duplication the whole\n // business-key design exists to prevent, and precisely what a store-level constraint refuses\n // for free.\n //\n // Required rather than suggested because this is an invariant with N call sites (every\n // destination any application ever declares) and a silent failure mode: nothing misbehaves\n // until two runs overlap, and by then the duplicate rows already exist. Found by the first\n // dogfood — the generated migration gave the key a PLAIN index and the omission was invisible\n // in every test, because a single-threaded upsert merges correctly with or without it.\n if (!isUniqueField(keyFieldSchema)) {\n refuse(\n `remoteKeyLocalField: '${declaration.remoteKeyLocalField}' must ALSO be declared .isUnique(). The schema planner derives a UNIQUE constraint from .isUnique() and NOT from .isBusinessKey(), so without it the store would accept two rows for one remote row whenever two runs overlap — the merge would be enforced only by this engine's read-then-write, never by the database.`\n );\n }\n\n for (const entry of declaration.mapping) {\n const targetSchema = requireMappedTarget(entry.localField, `mapping('${entry.localField}')`);\n if (entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD) {\n if (!entry.required && unwrapSchema(targetSchema) === targetSchema) {\n refuse(\n `mapping('${entry.localField}'): a non-required remote field can be ABSENT on a row, and absence lands as null — the target must be optional/nullable/defaulted, or declare required: true (absent rows are then rejected and reported per row).`\n );\n }\n if (entry.coercion === ExternalDataFieldCoercion.ISO_STRING_TO_DATE && !(unwrapSchema(targetSchema) instanceof z.ZodDate)) {\n refuse(`mapping('${entry.localField}'): coercion ISO_STRING_TO_DATE targets a date field.`);\n }\n // ⚠ Odoo spells ABSENT values as literal `false` (v3.1 §3 / PR-8), so on an Odoo source\n // the false→null coercion is the DEFAULT — resolved HERE, at authoring time, because this\n // is the one place the destination field's type is known: a genuine BOOLEAN target keeps\n // its `false` (Odoo booleans really are `false`), everything else would otherwise persist\n // a literal `false` into a string/date/number field. The runtime transform then applies\n // only RESOLVED coercions and carries no schema knowledge.\n if (\n declaration.binding.dialect === HttpApiTransportDialect.ODOO_JSONRPC\n && entry.coercion === ExternalDataFieldCoercion.NONE\n && !(unwrapSchema(targetSchema) instanceof z.ZodBoolean)\n ) {\n entry.coercion = ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL;\n }\n }\n }\n\n if (declaration.population === ExternalDataDestinationPopulation.CLOSED) {\n // Enumerate by the operation's EFFECTIVE semantics, never by its identifier: a CORE operation\n // is its own semantics, while a CUSTOM one declares them per variant through\n // `resourceOperationLike` (the same resolution `isDataModeVariantKeyAllowedForOperation`\n // uses). Both sources are unioned because neither sees the other's members — `coreOperations`\n // can name an operation with no authored configuration entry, and `operationsConfiguration`\n // is where a custom operation exists at all.\n const createShaped: ReadonlySet<unknown> = new Set<unknown>([\n CoreResourceOperation.CREATE,\n CoreResourceOperation.CREATE_MANY,\n ]);\n const declaredCreates = new Set<string>();\n for (const operation of (coreOperations as unknown[])) {\n if (createShaped.has(operation)) declaredCreates.add(String(operation));\n }\n for (const [operationKey, operationConfig] of Object.entries((operationsConfiguration ?? {}) as Record<string, unknown>)) {\n const variants = (operationConfig as { variants?: Array<{ resourceOperationLike?: unknown }> })?.variants ?? [];\n const effectiveOperations: unknown[] = variants.length > 0\n ? variants.map((variant) => variant.resourceOperationLike ?? operationKey)\n : [operationKey];\n if (effectiveOperations.some((effective) => createShaped.has(effective))) {\n declaredCreates.add(operationKey);\n }\n }\n if (declaredCreates.size > 0) {\n refuse(\n `population CLOSED: every row comes from the pipeline, so caller CREATE operations (${[...declaredCreates].sort().join(', ')}) are refused — declare population: OPEN if users may mint rows beside the synced ones. A CUSTOM operation counts when a variant declares a create-shaped resourceOperationLike.`\n );\n }\n }\n\n return declaration;\n })();\n\n const normalizedResourceRelationships = Resources_SharedUtils.ensureCompiledRelationships(\n resourceRelationships\n );\n\n // ========================================\n // VALIDATE DECORATOR COMBINATIONS\n // ========================================\n\n // Validate that mainSchema doesn't have invalid decorator combinations\n validateDecoratorCombinations(mainSchema, resourceIdentifier as string);\n\n // ========================================\n // DERIVE RESOURCE PRIMARY SCOPE\n // ========================================\n //\n // Two derivation signals are permitted (no silent default). A third\n // mechanism — polymorphic factories — is mechanically a special case of (2):\n //\n // 1. SELF-ANCHOR — the resource itself is one of the canonical scope roots\n // (USERS, ORGANIZATIONS, APPLICATION, ANONYMOUS_USERS). The PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE\n // map encodes that bijection.\n //\n // 2. FLAGGED RELATIONSHIP — exactly one relationship involving this resource\n // has `isPrimaryScope: true`. The rel-factory enforces that the flag can\n // only be set on a parent (not a child-side) and that the parent resolves\n // to a known scope-root in the primaryScopeMap, so reading\n // `primaryScopeRelationship.primaryScope` here always yields a valid enum.\n //\n // 3. POLYMORPHIC VARIANT (special case of 2) — resources built via\n // `createPolymorphicResourceConfigurations(...)` (e.g. SSO connections,\n // billing accounts, subscriptions, M2M webhooks). The polymorphic factory\n // auto-injects an `isPrimaryScope: true` rel per declared variant, so each\n // variant resolves through path (2) without the author having to re-declare\n // the anchor manually. If you reach the throw below for a polymorphic\n // resource, the variant declaration is missing its scope mapping — fix\n // the polymorphic config, NOT the registry rel list.\n //\n // If no derivation signal is present we THROW. The framework cannot quietly\n // assume a scope: scope drives auth, notifications, execution context, URL\n // routing, and cross-tenant isolation. A wrong default would be a silent\n // security regression. Every resource author MUST declare scope explicitly\n // via one of the three signals above.\n //\n // Migration: if you hit this throw, add a STANDALONE primary rel from the\n // owning scope-root (e.g. `ORGANIZATIONS → yourResource`,\n // `USERS → yourResource`, `APPLICATION → yourResource`) with\n // `accessScopeStrategy: STANDALONE` and `isPrimaryScope: true`. STANDALONE\n // keeps the rel inert for URL routing while declaring the structural\n // ownership anchor — see `resources-relationships.shared.factory.ts` Guard 1.\n\n const selfScopeEntry = Object.entries(PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE).find(\n ([, coreType]) => coreType === resourceIdentifier\n );\n\n const relevantRelationships = normalizedResourceRelationships.filter(rel =>\n rel.resourceType1 === resourceIdentifier || rel.resourceType2 === resourceIdentifier\n );\n const primaryScopeRelationship = relevantRelationships.find(rel => rel.isPrimaryScope === true);\n\n let resourcePrimaryScope: ResourcePrimaryScope;\n if (selfScopeEntry) {\n resourcePrimaryScope = selfScopeEntry[0] as ResourcePrimaryScope;\n } else if (primaryScopeRelationship?.primaryScope) {\n resourcePrimaryScope = primaryScopeRelationship.primaryScope;\n } else {\n throw createConfigurationError(\n `[${resourceIdentifier}] Cannot derive resourcePrimaryScope.\\n` +\n `\\n` +\n `A resource configuration MUST declare its primary scope via one of:\\n` +\n ` (1) Self-anchor — the resource itself is a canonical scope root\\n` +\n ` (USERS, ORGANIZATIONS, APPLICATION, ANONYMOUS_USERS).\\n` +\n ` (2) Flagged relationship — exactly one parent relationship carries\\n` +\n ` \\`isPrimaryScope: true\\` (parent resolves to a known scope root).\\n` +\n ` (3) Polymorphic variant — resources built via\\n` +\n ` \\`createPolymorphicResourceConfigurations(...)\\` get an\\n` +\n ` \\`isPrimaryScope: true\\` rel auto-injected per variant. If you\\n` +\n ` reach this throw for a polymorphic resource, your variant\\n` +\n ` declaration is missing its scope mapping — fix the polymorphic\\n` +\n ` config, NOT the registry rel list.\\n` +\n `\\n` +\n `No signal was found for resource '${resourceIdentifier}'.\\n` +\n `\\n` +\n `Fix: add a primary-anchor relationship in the registry. For an internal\\n` +\n `resource that should NOT be URL-routed under its scope parent, use:\\n` +\n `\\n` +\n ` createResourcesRelationship(\\n` +\n ` CoreResourceType.ORGANIZATIONS, '${resourceIdentifier as string}',\\n` +\n ` ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\\n` +\n ` {\\n` +\n ` accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\\n` +\n ` isPrimaryScope: true,\\n` +\n ` nature: RelationshipNature.REFERENCE,\\n` +\n ` contextPolicy: { enabled: false },\\n` +\n ` }\\n` +\n ` )\\n` +\n `\\n` +\n `For a routable child resource, drop the STANDALONE strategy and add\\n` +\n `\\`isPrimaryScope: true\\` to the existing parent relationship.\\n` +\n `\\n` +\n `Background: the framework no longer falls back to a silent ORGANIZATIONS\\n` +\n `default — primary scope drives auth, notifications, execution context,\\n` +\n `URL routing, and cross-tenant isolation, so a wrong default would be a\\n` +\n `silent security regression. See \\`resources-config.shared.factory.ts\\`\\n` +\n `(DERIVE RESOURCE PRIMARY SCOPE) for the full rationale.`\n );\n }\n\n // ========================================\n // isAnonymizable VALIDATION & ENRICHMENT (W7.3a)\n // ========================================\n\n let effectiveMainSchema: TMainSchema = mainSchema;\n let effectiveResourceRelationships = normalizedResourceRelationships;\n let effectiveSystemAccessPolicy = systemAccessPolicy;\n\n if (isAnonymizable) {\n if (resourcePrimaryScope !== ResourcePrimaryScope.USER_SELF) {\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires primaryScope USER_SELF, got ${resourcePrimaryScope}.`\n );\n }\n\n try {\n const shape = getZodObjectShape(mainSchema);\n const userIdField = shape['userId'];\n if (!userIdField) {\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires a 'userId' field in mainSchema.`\n );\n }\n const nullResult = (userIdField as z.ZodTypeAny).safeParse(null);\n if (!nullResult.success) {\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires 'userId' field to accept null ` +\n `(anonymous records have no userId). Use z.string().nullable().`\n );\n }\n } catch (e) {\n if ((e as any)?.type === ErrorType.CONFIGURATION) throw e;\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true but mainSchema is not a ZodObject (cannot validate userId field).`\n );\n }\n\n if (!coreOperations.includes(CoreResourceOperation.LIST as any)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires LIST in coreOperations (needed for transposition lookup).`\n );\n }\n\n if (!coreOperations.includes(CoreResourceOperation.UPDATE_MANY as any)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires UPDATE_MANY in coreOperations (needed for transposition batch update).`\n );\n }\n\n effectiveMainSchema = (mainSchema as any).extend({\n anonymousUserId: z.string().optional().nullable().isDBIndexed()\n }) as TMainSchema;\n\n const anonymousRelationship = createResourcesRelationship(\n CoreResourceType.ANONYMOUS_USERS as ResourceType,\n resourceIdentifier,\n ResourceRelationshipCardinality.ONE,\n primaryScopeRelationship!.cardinality2,\n {\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n foreignKeyField: 'anonymousUserId',\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n nature: primaryScopeRelationship!.resolvedSemantics.nature,\n read: primaryScopeRelationship!.read,\n contextPolicy: { enabled: false },\n childOperations: primaryScopeRelationship!.childOperations?.lifecycle\n ? { lifecycle: primaryScopeRelationship!.childOperations.lifecycle }\n : undefined,\n }\n );\n effectiveResourceRelationships = [...normalizedResourceRelationships, anonymousRelationship];\n\n // ── Derive the transposition system-access grant (W7.3a) ──────────────\n //\n // Anonymous→user ownership transposition (`AnonymousSessionBackendService`)\n // rewrites `{ userId, anonymousUserId }` across every anonymizable resource\n // via `SystemAccessBackendService.updateManyAsSystem`. That primitive is\n // fail-closed on `systemAccessPolicy.updateMany` PER RESOURCE, and both FKs\n // it writes are context-auto-populated names the client-shaped request DTO\n // strips — so WITHOUT the grant the transposition would either throw\n // `CONFIGURATION` (fail-closed) or silently no-op, stranding the converting\n // user's rows under the anonymous id until the cleanup batch deletes them\n // (user-visible data loss).\n //\n // This grant is DERIVED, not authored, precisely because it is not an\n // incidental capability: it is THE mechanism `isAnonymizable` exists to\n // enable. The factory already REQUIRES `UPDATE_MANY` in `coreOperations`\n // above \"for transposition batch update\"; that core operation is\n // unreachable by the transposition service without this system-access\n // opt-in, so deriving it here COMPLETES an existing coupling rather than\n // inventing a new one — and removes a guaranteed per-app footgun (every\n // app marking a resource `isAnonymizable` would otherwise have to remember\n // the grant, and the engine core ships zero anonymizable resources to model\n // it from).\n //\n // Distinct from the `systemAccessPolicy` ⟂ `isSystemResource` separation\n // documented on the policy type: `isSystemResource` is a broad, ACL-\n // orthogonal marker (framework infra does NOT imply an ACL bypass is\n // acceptable), whereas `isAnonymizable` has a single, specific engine\n // behaviour that requires exactly `updateManyAsSystem`. The derived value\n // is materialised into the RESOLVED config below (not hidden in factory\n // control flow), so specs, audits, and `assertSystemAccessAllowed` all see\n // `updateMany: ALLOWED`. Any explicitly-authored `systemAccessPolicy` on an\n // anonymizable resource is preserved for its other verbs; only `updateMany`\n // is forced ALLOWED (a transposition-required resource cannot opt out of\n // its own transposition).\n //\n // FAIL-LOUD (not silent-override): if the author EXPLICITLY declared\n // `updateMany: FORBIDDEN`, that contradicts `isAnonymizable` (the resource\n // asks for transposition yet forbids the only primitive that performs it).\n // Silently flipping it to ALLOWED would erase an explicit security\n // declaration — dishonest. Throw instead. We read the RAW authored policy\n // (`params.systemAccessPolicy`), NOT the destructured value: an unauthored\n // policy is defaulted to all-verbs-FORBIDDEN above, and forcing THAT to\n // ALLOWED is the intended, non-contradictory derive (the common case). Only\n // a hand-written `updateMany: FORBIDDEN` is the contradiction we reject.\n if (params.systemAccessPolicy?.updateMany === ResourceSystemAccessMode.FORBIDDEN) {\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires systemAccessPolicy.updateMany = ALLOWED ` +\n `(anonymous→user transposition rewrites { userId, anonymousUserId } via updateManyAsSystem), but ` +\n `this resource explicitly authored updateMany: FORBIDDEN. A transposition-required resource cannot ` +\n `opt out of its own transposition — remove the explicit FORBIDDEN (the grant is derived automatically) ` +\n `or drop isAnonymizable.`\n );\n }\n effectiveSystemAccessPolicy = {\n ...systemAccessPolicy,\n updateMany: ResourceSystemAccessMode.ALLOWED,\n };\n }\n\n // ========================================\n // retentionPolicy VALIDATION & ENRICHMENT (impersonalization-on-erasure)\n // ========================================\n //\n // Mirror of the isAnonymizable branch above, for the OTHER trusted-write axis:\n // on erasure a retention-governed resource is impersonalized-and-retained\n // (personal fields scrubbed via `updateManyAsSystem`, row KEPT) instead of\n // hard-deleted. Injects the per-record `retentionStatus` marker and derives the\n // system-access grants the capability requires. RESOURCE-level: the per-edge\n // trigger (`onParentDelete.strategy = IMPERSONALIZE_AND_RETAIN`) and per-field scrub\n // (`.impersonalizeWith()`) are declared separately.\n if (retentionPolicy?.mode) {\n // PRESENCE half of the retention operation contract: each required op must be declared at all.\n // The RESOLVABILITY half — that the declared op has a variant the retention primitives can\n // actually dispatch — runs later, once the operation variants are assembled (search\n // `RETENTION_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS`). Deliberately two checks, because they have\n // two different fixes: \"declare the op\" vs \"declare it with a service-resolvable variant\".\n for (const { operation: requiredOperation, why } of RETENTION_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS) {\n if (!coreOperations.includes(requiredOperation as any)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires ${requiredOperation} in coreOperations (${why}).`\n );\n }\n }\n\n // Guard (framework-quality): `retentionStatus` / `impersonalizedAt` are framework-reserved\n // injected names. Zod-4 `.extend()` SILENTLY OVERWRITES a duplicate key, so a resource that\n // already declares one would have its own field clobbered on opt-in — fail loud instead. The\n // same `getZodObjectShape` call also yields a friendly config error if `mainSchema` is not a\n // ZodObject (the marker cannot be injected into a non-object schema).\n // EXPLICIT object check. (Do NOT rely on `getZodObjectShape` throwing — it returns `{}` for a\n // union, so a try/catch around it is dead code and the real failure surfaces later as an\n // undiagnosable `effectiveMainSchema.extend is not a function`.)\n if (!isZodObject(effectiveMainSchema)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires a ZodObject mainSchema (cannot inject the ` +\n `retentionStatus marker into a non-object schema — polymorphic/union mainSchemas are not yet supported).`\n );\n }\n\n const existingShape = getZodObjectShape(effectiveMainSchema);\n for (const reservedField of ['retentionStatus', 'impersonalizedAt'] as const) {\n if (existingShape[reservedField]) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy injects a reserved '${reservedField}' field, but this ` +\n `resource already declares one. Rename that field or drop retentionPolicy (the marker is factory-injected).`\n );\n }\n }\n\n // ========================================\n // IMPERSONALIZE TREATMENT VALIDATION — fail loud at CONFIG BUILD, not on the erasure path.\n // ========================================\n //\n // The impersonalize writer scrubs via `updateManyAsSystem`, whose STRICT update-DTO parse runs\n // over the scrub patch. A treatment the declared field schema cannot accept therefore throws\n // INSIDE the parent-delete transaction and ROLLS BACK the erasure — the worst possible moment to\n // discover a config mistake. Every check below is a pure `safeParse` against the AUTHORED field\n // schema, so it catches every axis at once without a type taxonomy:\n //\n // - REMOVE writes `null`, which the field-clearing contract resolves into either a stored null\n // (null-accepting field) or a removed key (merely `.optional()`). Both are what REMOVE asks\n // for, so the requirement is that the field be CLEARABLE — i.e. not required and not\n // `.default()`-wrapped, since a default's output type is non-optional.\n // HISTORY, because this comment justified a stricter guard for months: update DTOs used to\n // be made `.optional()` and NEVER `.nullable()`, so a non-nullish field really did reject\n // the scrub, and the capability was non-functional for every non-nullable field. That\n // changed when `toPatchOptionalField` began admitting null for clearable fields; the guard\n // below was left demanding `.nullish()` and so failed startup on valid declarations.\n // - MASK writes the field's EFFECTIVE mask value — its own `maskValue` override, or\n // `IMPERSONALIZE_MASK_CONSTANT`. Beyond the obvious number/date/enum/boolean mismatches, the\n // default constant also fails CONSTRAINED strings — `z.email()`, `z.uuid()`, `.min(n)` — i.e.\n // exactly the PII fields most likely to be masked, which is why the override exists. A\n // \"MASK is string-only\" rule would NOT be sufficient. An override is validated against the\n // field's own schema here, and is rejected outright on a non-MASK treatment (nothing would\n // write it).\n // - A resource that opts into retentionPolicy but declares ZERO treatments would flip rows to\n // `RETAINED` with every personal field intact: a compliance-grade lie (it LOOKS erased).\n for (const [fieldName, fieldSchema] of Object.entries(existingShape)) {\n const treatment = getImpersonalizeTreatment(fieldSchema as z.ZodTypeAny);\n if (treatment === undefined) continue;\n\n // Floor fields are never scrubbed, so their schema need not accept a scrub value. Reuse the\n // writer's own floor predicate — one authority, so the guard can never drift from the scrub.\n if (isImpersonalizeNeverScrubFloorField(fieldName)) continue;\n\n // D1 allows SEVERING the person-link (`userId` / `anonymousUserId`) — but only when a NON-person\n // scope survives to anchor the retained row. If the person-link IS the resource's primary scope,\n // nulling it strips the row's only tenant anchor: contextual scoping can no longer reach it, so\n // the retained record becomes invisible even to the audited see-through path that retention\n // exists to serve (retained-but-unreachable ≠ retained).\n const severedScope = FIELD_IDENTIFIER_TO_PRIMARY_SCOPE[fieldName];\n if (\n treatment === RedactionType.REMOVE &&\n severedScope !== undefined &&\n severedScope === resourcePrimaryScope\n ) {\n throw createConfigurationError(\n `[${resourceIdentifier}] field '${fieldName}' declares impersonalize treatment REMOVE, but it is this ` +\n `resource's PRIMARY scope ('${severedScope}'). Severing the primary-scope link would leave the retained ` +\n `row with no tenant anchor — unreachable through contextual scoping, including the audited see-through ` +\n `read. Keep the primary-scope link (use KEEP) and scrub the personal FIELDS instead.`\n );\n }\n\n // NOTE ON UNIQUE-INDEXED FIELDS (gate G-BKEY): a scrub writes the SAME value to every row in\n // the batch (`null` for REMOVE, one shared mask constant for MASK), which on a plain unique\n // index would collide (E11000) and abort the erasure. That is NOT rejected here, because the\n // schema layer scopes every unique index on a retention-governed resource to NON-RETAINED rows\n // (`partialFilterExpression`, see `buildRetentionPartialFilterExpression`): the scrubbed rows\n // become RETAINED in the same write, leave the index, and therefore cannot collide — the same\n // property that stops a retained row from permanently locking out re-creation of its key.\n // ⚠️ This guard's absence DEPENDS on that partial index. If the partial filter is ever removed,\n // a treatment on a unique field becomes an erasure-aborting defect again.\n\n // A maskValue is meaningful ONLY under MASK — no other treatment writes it. Declaring one\n // elsewhere means the author believes a specific value will be stored while the writer would\n // null the field (REMOVE) or leave it untouched (KEEP): the declaration and the behaviour\n // disagree, which is the same class of silent compliance lie the zero-scrub guard prevents.\n // Checked BEFORE the per-treatment branches, and independently of them — as an arm of that\n // if/else chain it would be unreachable for exactly the treatments it needs to reject.\n if (treatment !== RedactionType.MASK && getImpersonalizeMaskValue(fieldSchema as z.ZodTypeAny) !== undefined) {\n throw createConfigurationError(\n `[${resourceIdentifier}] field '${fieldName}' declares an impersonalize maskValue but its treatment is ` +\n `'${treatment}', not MASK — nothing would ever write that value. Use MASK to store it, or drop the maskValue.`\n );\n }\n\n if (treatment === RedactionType.REMOVE) {\n // REMOVE writes `null`, and the field-clearing contract decides what that PERSISTS as: a\n // null-accepting field stores the null, a merely-`.optional()` field has the key removed.\n // Either outcome is what REMOVE asks for, so the requirement is CLEARABILITY, not\n // null-acceptance.\n //\n // This guard used to demand `.nullish()` and justify it with \"update DTOs are made\n // .optional(), never .nullable()\". That was true when it was written and is not any more —\n // `toPatchOptionalField` now admits null for every clearable field. Left unchanged, the\n // guard rejected a perfectly valid `.optional()` + REMOVE declaration at CONFIG BUILD, i.e.\n // it failed application startup, and explained the refusal with a rule that no longer\n // exists.\n if (!mainSchemaFieldIsClearable(fieldSchema as z.ZodTypeAny)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] field '${fieldName}' declares impersonalize treatment REMOVE, which clears the ` +\n `field, but the field is required (or carries a \\`.default()\\`, whose output type is non-optional). A ` +\n `field that must always hold a value cannot be scrubbed by removal — declare it \\`.optional()\\` or ` +\n `\\`.nullish()\\`, or use MASK to overwrite it with a placeholder instead.`\n );\n }\n } else if (treatment === RedactionType.MASK) {\n // Validate the EFFECTIVE value — the field's own `maskValue` override when it declares one,\n // the framework constant otherwise — resolved through the SAME helper the scrub writer uses,\n // so a config that passes here cannot produce a write the update DTO rejects mid-erasure.\n const effectiveMaskValue = resolveImpersonalizeMaskValue(fieldSchema as z.ZodTypeAny);\n if (!(fieldSchema as z.ZodTypeAny).safeParse(effectiveMaskValue).success) {\n throw createConfigurationError(\n effectiveMaskValue === IMPERSONALIZE_MASK_CONSTANT\n ? `[${resourceIdentifier}] field '${fieldName}' declares impersonalize treatment MASK, but its schema ` +\n `rejects the default mask constant '${IMPERSONALIZE_MASK_CONSTANT}'. That constant is an unconstrained ` +\n `string, so a number/date/enum/boolean — or a CONSTRAINED string such as z.email()/z.uuid()/.min(n) — ` +\n `cannot hold it. Either declare a field-specific value the schema accepts ` +\n `(\\`.impersonalizeWith(MASK, { maskValue: '...' })\\`), or use REMOVE on a \\`.nullish()\\` field.`\n : `[${resourceIdentifier}] field '${fieldName}' declares impersonalize treatment MASK with ` +\n `maskValue '${effectiveMaskValue}', but its own schema rejects that value. The mask is written ` +\n `verbatim through the strict update-DTO parse, so it must satisfy every constraint the field ` +\n `declares (format, length, enum membership).`\n );\n }\n } else if (treatment === RedactionType.RESET) {\n /*\n * RESET returns the field to its schema default — the treatment for a field that is non-nullable\n * WITH a `.default()`, where REMOVE (needs clearable) and MASK (needs a string) both refuse.\n *\n * The RULES live in `resolveImpersonalizeResetValue`, deliberately, and are NOT restated here: it\n * refuses a field with no default, and one that is merely `.optional()` (whose default IS\n * undefined, so nothing would be scrubbed). One authority, because a second copy of either check\n * would drift from the writer that actually runs them.\n *\n * What this arm adds is WHERE the failure surfaces. Called here, the refusal is a CONFIGURATION\n * error naming the RESOURCE. Left to fall through, the same resolver still runs — via\n * `buildImpersonalizeScrubPatch` further down this function — but throws a bare Error naming only\n * the field, which boot does not classify as a configuration fault.\n */\n try {\n resolveImpersonalizeResetValue(fieldSchema as z.ZodTypeAny, fieldName);\n } catch (error) {\n throw createConfigurationError(\n `[${resourceIdentifier}] ${error instanceof Error ? error.message : String(error)}`\n );\n }\n }\n }\n\n // Count what the WRITER would actually scrub, not what was merely declared. `KEEP` treatments and\n // treatments on never-scrub floor fields are both skipped by `buildImpersonalizeScrubPatch`, so\n // counting declarations would let a resource satisfy this guard with a patch that is EMPTY — rows\n // flipping to RETAINED with every field intact, which is precisely the compliance lie the guard\n // exists to prevent. Deriving the count from the writer keeps ONE authority for \"what gets scrubbed\".\n // FAIL LOUD on a NESTED treatment. Both the guard above and the writer walk TOP-LEVEL keys only\n // (`getMergedObjectOrUnionShape` merges union options; it does not descend into nested objects, and\n // `getMetadataRecursive` traverses wrappers but never a ZodObject's shape). So a\n // `.impersonalizeWith()` declared on a nested field — `billingContact.email`, or a nested\n // `z_file()` — is SILENTLY IGNORED: the row flips to RETAINED while that field, and any file linked\n // under its dotted path, survive intact. That is the compliance lie this whole block exists to\n // prevent, reached through a door the top-level walk cannot see. Recursive scrubbing is deliberately\n // out of v1 scope, so an unscrubable nested treatment must be a BOOT ERROR rather than a silent skip.\n assertNoNestedImpersonalizeTreatment(effectiveMainSchema, resourceIdentifier);\n\n // The two modes assert OPPOSITE things about this resource's fields, so each fails loud on the\n // other's shape. Neither is a warning: a mismatch here means the config claims something about\n // personal data that the runtime would not honour.\n const effectiveScrubPatch = buildImpersonalizeScrubPatch(effectiveMainSchema);\n if (retentionPolicy.mode === ErasureRetentionMode.RETAIN_ONLY) {\n // RETAIN_ONLY asserts \"this resource holds no personal data of its own\". A treatment contradicts\n // that claim — and would be silently ignored at erasure time, since RETAIN_ONLY writes only the\n // markers. Fail rather than let the declaration and the behaviour disagree.\n if (Object.keys(effectiveScrubPatch).length > 0) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy.mode = RETAIN_ONLY asserts this resource holds no personal data of ` +\n `its own, but field(s) [${Object.keys(effectiveScrubPatch).join(', ')}] declare an impersonalize treatment. ` +\n `Those treatments would never run. Use mode = RETAIN_AND_IMPERSONALIZE to actually scrub them, or remove them.`\n );\n }\n /*\n * The SECOND direction, and until 2026-08-31 it did not exist.\n *\n * The check above sees a field with a TREATMENT. This one sees a field DECLARED as personal data\n * and given no treatment — which is the shape a wrong `RETAIN_ONLY` actually takes. Without it,\n * the cheap mode was also the one that failed silently: a resource whose fields carry\n * `.dataCategories()` could assert it holds no personal data, pass every gate, and put that\n * assertion into a governed document. `RETAIN_AND_IMPERSONALIZE` never had the hole — it is\n * refused when nothing would be scrubbed.\n *\n * This catches a CONTRADICTION, not an omission. A resource that classified nothing still passes,\n * because \"nobody declared a category\" and \"there is no personal data\" are indistinguishable\n * here; that is the category inventory's question. A clean result is not a proof.\n */\n const declaredPersonalDataFields = collectDeclaredPersonalDataFields(effectiveMainSchema);\n if (declaredPersonalDataFields.length > 0) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy.mode = RETAIN_ONLY asserts this resource holds no personal data of ` +\n `its own, but field(s) [${declaredPersonalDataFields.join(', ')}] declare .dataCategories(). The resource ` +\n `cannot both hold personal data and hold none. Use mode = RETAIN_AND_IMPERSONALIZE and give those fields an ` +\n `impersonalize treatment, or — if the category is wrong — correct the field. Scope foreign keys and ` +\n `createdByUserId are excluded here: they link a row to a person without being personal data the row holds.`\n );\n }\n } else if (Object.keys(effectiveScrubPatch).length === 0) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy.mode = RETAIN_AND_IMPERSONALIZE but NO field would actually be ` +\n `scrubbed (KEEP treatments and treatments on never-scrub floor fields such as scope FKs / createdByUserId ` +\n `do not count). Erasure would flip rows to RETAINED with every personal field intact — a record ` +\n `that looks scrubbed but is not. Mark at least one non-floor personal field REMOVE or MASK, or — if this ` +\n `resource genuinely holds no personal data of its own — declare mode = RETAIN_ONLY instead.`\n );\n }\n\n // Inject the per-record retention marker. Server-managed (excluded from client\n // create/update, hidden), DB-indexed for the hidden-by-default filter predicate\n // + the future disposal clock. Defaults to ACTIVE; only the impersonalize writer\n // flips it to RETAINED via updateManyAsSystem (which re-attaches verb-excluded\n // fields after the strict parse — see deriveTrustedSystemWritePreservedFields).\n effectiveMainSchema = (effectiveMainSchema as any).extend({\n retentionStatus: RetentionStatusSchema\n .default(RetentionStatus.ACTIVE)\n .isDBIndexed()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isHidden(),\n impersonalizedAt: z.date()\n .optional()\n .isDBIndexed()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isHidden(),\n }) as TMainSchema;\n\n // Derive the impersonalization system-access grants (parallel to the\n // isAnonymizable updateMany derive above): `updateMany` for the in-place scrub,\n // `seeRetained` for the audited see-through read of retained rows. FAIL-LOUD, not\n // silent-override: if the author EXPLICITLY declared either verb FORBIDDEN, that\n // contradicts retentionPolicy (the resource asks to be retained-and-scrubbed yet\n // forbids the only primitive that performs / audits it). We read the RAW authored\n // policy (`params.systemAccessPolicy`) — an unauthored policy defaults to\n // all-verbs-FORBIDDEN, and deriving THAT to ALLOWED is the intended common case.\n if (params.systemAccessPolicy?.updateMany === ResourceSystemAccessMode.FORBIDDEN) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires systemAccessPolicy.updateMany = ALLOWED ` +\n `(the impersonalize writer scrubs in place via updateManyAsSystem), but this resource explicitly ` +\n `authored updateMany: FORBIDDEN. Remove it (the grant is derived automatically) or drop retentionPolicy.`\n );\n }\n if (params.systemAccessPolicy?.seeRetained === ResourceSystemAccessMode.FORBIDDEN) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires systemAccessPolicy.seeRetained = ALLOWED ` +\n `(the audited see-through read of retained rows), but this resource explicitly authored ` +\n `seeRetained: FORBIDDEN. Remove it (the grant is derived automatically) or drop retentionPolicy.`\n );\n }\n effectiveSystemAccessPolicy = {\n ...effectiveSystemAccessPolicy,\n updateMany: ResourceSystemAccessMode.ALLOWED,\n seeRetained: ResourceSystemAccessMode.ALLOWED,\n };\n }\n\n // ── dataSubjectPolicy: WHO the row is, and whose session an erasure ends ──────────────────────\n //\n // Placed AFTER the retention operation contract on purpose: a config can be wrong in several ways\n // at once, and the contract's errors are the more specific ones (\"declare UPDATE_MANY\", \"rename\n // your reserved field\"). Running this first masked them, so an author fixing a missing operation\n // was told to declare a data-subject policy instead.\n //\n // Paired with `retentionPolicy` in BOTH directions, because a retention-governed resource is\n // exactly one that `eraseSubjectAsSystem` accepts as a subject (the orchestrator refuses a subject\n // with no retention policy), and a `dataSubjectPolicy` on anything else describes an erasure that\n // can never happen.\n //\n // Undeclared is REFUSED rather than defaulted: there is no safe default. Assuming\n // NO_PRINCIPAL would silently drop a real person's session revocation; assuming a linked\n // principal would revoke whoever a user foreign key happens to name — on `TODOS` that is the\n // author, the assignee and the escalation contact, none of whom is the data subject. Refusing is\n // what forces the decision, matching the subject-EXPORT model's treatment of an undeclared resource.\n if (retentionPolicy?.mode && !dataSubjectPolicy) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires a dataSubjectPolicy. A retention-governed ` +\n `resource can be passed to eraseSubjectAsSystem as a data subject, so it must declare WHOSE ` +\n `SESSION an erasure ends: ResourceDataSubjectKind.NO_PRINCIPAL (nobody's — either an ordinary ` +\n `record whose user foreign keys name actors rather than the subject, OR a person with no ` +\n `account such as a CRM contact or a lead), SELF_PRINCIPAL (the row is the person and its own ` +\n `id is the session principal), or LINKED_PRINCIPAL with sessionPrincipalField (the person ` +\n `signs in as a different USERS row). Note this is NOT \"is the row about a person\" — that is ` +\n `answered by retentionPolicy.mode. This is never inferred from a user foreign key — doing so ` +\n `would revoke the sessions of owners and assignees instead of the subject.`\n );\n }\n if (dataSubjectPolicy && !retentionPolicy?.mode) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy requires retentionPolicy. Without one this resource ` +\n `can never be an erasure subject (eraseSubjectAsSystem refuses a subject that is not ` +\n `retention-governed), so the declaration would describe an erasure that cannot happen.`\n );\n }\n if (dataSubjectPolicy) {\n const namesPrincipalField = dataSubjectPolicy.kind === ResourceDataSubjectKind.LINKED_PRINCIPAL;\n if (namesPrincipalField && !dataSubjectPolicy.sessionPrincipalField) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy.kind = LINKED_PRINCIPAL requires ` +\n `sessionPrincipalField — the field naming the USERS row whose session an erasure of this row ` +\n `must end. Without it the erasure has no principal to revoke and the declaration would be inert.`\n );\n }\n if (!namesPrincipalField && dataSubjectPolicy.sessionPrincipalField) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy.sessionPrincipalField is only valid under ` +\n `kind = LINKED_PRINCIPAL (got '${dataSubjectPolicy.kind}'). Under SELF_PRINCIPAL the row's own ` +\n `id IS the principal, and under NO_PRINCIPAL there is no principal at all — so naming a ` +\n `field here is a contradiction, not a redundancy.`\n );\n }\n // The named link must not ALSO be scrubbed. This is a COHERENCE guard, not a prerequisite of the\n // revocation: the principal is resolved BEFORE the scrub (a post-commit read is impossible — the\n // row is RETAINED and hidden by then, and the only see-through door demands a privileged human),\n // so a scrubbed field would still be readable when it matters. It is refused because declaring one\n // field to be BOTH the link to a person and personal data to destroy is a contradiction, and it\n // leaves the retained row unable to say whose session was ended.\n //\n // Derived from the WRITER (`buildImpersonalizeScrubPatch`) rather than from a treatment count —\n // the same discipline the zero-scrub guard uses, because only the writer knows which declarations\n // actually produce a scrub.\n if (namesPrincipalField && mainSchema instanceof z.ZodObject) {\n const principalField = dataSubjectPolicy.sessionPrincipalField as string;\n if (!(principalField in (mainSchema.shape as Record<string, unknown>))) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy.sessionPrincipalField = '${principalField}' is not ` +\n `a top-level field of this resource's mainSchema.`\n );\n }\n if (principalField in buildImpersonalizeScrubPatch(mainSchema)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy.sessionPrincipalField = '${principalField}' is ` +\n `SCRUBBED by the erasure (it carries an .impersonalizeWith() treatment the writer acts on). A ` +\n `field cannot be both the link naming this person's login and personal data to destroy — the ` +\n `retained row would be left unable to say whose session was ended. Remove the treatment from ` +\n `that field (a user id is a link, not personal data of this row) or name a different field.`\n );\n }\n }\n\n // The system LIST grant the principal lookup needs.\n //\n // `eraseSubjectAsSystem` resolves the principal by reading the subject rows through\n // `listAsSystem`, which fail-closes on `systemAccessPolicy.list`. The retention derivation grants\n // only `updateMany` + `seeRetained`, and an unauthored policy is all-verbs-FORBIDDEN — so without\n // this the lookup would throw, be swallowed as best-effort, resolve to NO principals, and the\n // erased person's session would quietly survive. That is the exact failure this whole capability\n // exists to close, so the grant is derived from the declaration that requires it.\n //\n // Reads the RAW authored policy (`params.systemAccessPolicy`) — an unauthored policy defaults to\n // all-verbs-FORBIDDEN, and deriving THAT to ALLOWED is the intended common case.\n //\n // Scoped to LINKED_PRINCIPAL deliberately: SELF_PRINCIPAL needs no read (the subject ids ARE the\n // user ids) and NO_PRINCIPAL reads nothing at all, so neither earns a widened system surface.\n if (namesPrincipalField) {\n if (params.systemAccessPolicy?.list === ResourceSystemAccessMode.FORBIDDEN) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy.kind = LINKED_PRINCIPAL requires ` +\n `systemAccessPolicy.list = ALLOWED (the erasure reads the subject rows to resolve the session ` +\n `principal), but this resource explicitly authored list: FORBIDDEN. Remove it (the grant is ` +\n `derived automatically) or declare a different dataSubjectPolicy.kind.`\n );\n }\n effectiveSystemAccessPolicy = {\n ...effectiveSystemAccessPolicy,\n list: ResourceSystemAccessMode.ALLOWED,\n };\n }\n }\n\n // ========================================\n // DATA-CATEGORY VOCABULARY VALIDATION\n // ========================================\n //\n // `.dataCategories()` stores opaque strings: `zod-decorators` sits BELOW this package and cannot\n // import `PersonalDataCategory`, so its chokepoint can only check that non-empty strings were\n // declared. This is the layer that owns the enum, so this is where membership is checked.\n //\n // UNCONDITIONAL, unlike the impersonalize guards above — those run only inside `retentionPolicy`\n // because a treatment is meaningless without one. A data category is meaningful on any resource:\n // a hard-deleted resource still HOLDS personal data while it exists, and a privacy notice must\n // enumerate it. Gating this on retentionPolicy would silently exempt exactly the resources that\n // opted out of retention.\n //\n // A typo'd category is worse than an undeclared one and that is why this is a BOOT ERROR rather\n // than a warning: `'contact_details'` (underscore) is not a member, so the field would be counted\n // as CATEGORIZED by the gap report — it carries a declaration — while contributing nothing to the\n // notice's category list. The field disappears from the inventory while looking annotated in the\n // schema, which is the failure this whole capability exists to prevent.\n //\n // TOP-LEVEL fields only, deliberately matching `resolveResourcePersonalDataCategories`: a nested\n // declaration is invisible to the reader, so validating it here would certify a value nothing\n // consumes. Unlike a nested `.impersonalizeWith()` — which is a boot error because the row would\n // flip to RETAINED with the field intact — a nested category breaks nothing at runtime; it simply\n // never reaches a notice.\n if (isZodObject(effectiveMainSchema)) {\n for (const [fieldName, fieldSchema] of Object.entries(getZodObjectShape(effectiveMainSchema))) {\n const declared = getDataCategories(fieldSchema as z.ZodTypeAny);\n if (declared === undefined) continue;\n const unknownCategories = unknownPersonalDataCategories(declared);\n if (unknownCategories.length > 0) {\n throw createConfigurationError(\n `[${resourceIdentifier}] field '${fieldName}' declares data categor${unknownCategories.length === 1 ? 'y' : 'ies'} ` +\n `[${unknownCategories.join(', ')}] that ${unknownCategories.length === 1 ? 'is' : 'are'} not a PersonalDataCategory member. ` +\n `A value outside the vocabulary counts the field as CATEGORIZED — so it is excluded from the ` +\n `uncategorized-field gap report — while contributing nothing to the privacy notice's category list. ` +\n `Use a PersonalDataCategory member, or drop the declaration if the field holds no personal data.`\n );\n }\n }\n }\n\n // ========================================\n // TRANSFORM RESOURCE RELATIONSHIPS\n // ========================================\n\n const { processedResourceRelationships, availableParentResourceTypes } = transformResourceRelationships(effectiveResourceRelationships, resourceIdentifier);\n\n // ========================================\n // DERIVE SUMMARY SCHEMA FROM isSummaryField DECORATORS\n // ========================================\n\n // Auto-derive summary schema for LIST/SEARCH operations from isSummaryField decorators\n // This replaces manual responseSummaryDto definitions\n // Must be computed BEFORE operations loop so LIST operations can use it\n const derivedSummarySchema = inheritenceSchemaDefinition\n ? ResourcesSummaryUtils.deriveSummarySchemaForDiscriminatedUnion(\n effectiveMainSchema as unknown as z.ZodObject<z.ZodRawShape>,\n inheritenceSchemaDefinition as unknown as ResourceConfiguration_InheritanceSchemaDefinition<any, z.ZodObject<z.ZodRawShape>>\n )\n : ResourcesSummaryUtils.deriveSummarySchema(effectiveMainSchema);\n\n // ========================================\n // FLATTEN OPERATIONS AND SEARCHABLE CONFIGURATIONS\n // ========================================\n\n const operations: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>[] = [];\n\n // Extract autoVariants config (default all true)\n const autoVariants = params.autoVariants || {};\n const autoVariantsRead = autoVariants.read || {};\n const autoVariantsList = autoVariants.list || {};\n const enableReadSummary = autoVariantsRead.enableSummary !== false; // default true\n const enableReadContext = autoVariantsRead.enableContext !== false; // default true\n const enableListSummary = autoVariantsList.enableSummary !== false; // default true\n const enableListContext = autoVariantsList.enableContext !== false; // default true\n\n // Process operation configurations\n for (const [operation, config] of Object.entries(operationsConfiguration) as [ValidOperationKeys<TCustomOperationEnum, TCoreOperationEnum>, ResourceConfiguration_Operation_BuilderParameters<TMainSchema>][]) {\n assertOperationPathKeySegment(String(operation), 'operation identifier', String(operation));\n\n // Validate isDefault logic by grouping variants by their variantType\n const variantsByType = new Map<ResourceOperationVariantType, ResourceConfiguration_OperationVariant_BuilderParameters<TMainSchema>[]>();\n\n // Group variants by their type\n config.variants.forEach(variant => {\n if (!variantsByType.has(variant.variantType)) {\n variantsByType.set(variant.variantType, []);\n }\n variantsByType.get(variant.variantType)!.push(variant);\n });\n\n // Validate each variant type group. URL-bearing variants form a shared\n // operation identity space (`API_CALL` and `API_CALL_WITH_CALLBACK` are\n // both selected by operation/default/key at many call sites), so their\n // default/key invariants are validated as one combined group below.\n for (const [variantType, variantsGroup] of variantsByType.entries()) {\n if (!isUrlisableOperationVariantType(variantType) && variantsGroup.length > 1) {\n const explicitDefaults = variantsGroup.filter((variant) =>\n variant.isDefault === true\n );\n if (explicitDefaults.length === 0) {\n throw createConfigurationError(`Operation '${operation}' with multiple ${variantType} variants must have at least one with isDefault=true`);\n }\n if (explicitDefaults.length > 1) {\n throw createConfigurationError(`Operation '${operation}' with multiple ${variantType} variants cannot declare more than one with isDefault=true`);\n }\n }\n\n if (isUrlisableOperationVariantType(variantType)) {\n for (const variant of variantsGroup) {\n // 🔒 Fail-closed guard: a URL-bearing variant with an EMPTY roles array\n // is not \"skip the role check\" — it is a guaranteed 403. The runtime gate\n // (`AuthorizationsBackendService.validateOperationRoles`) evaluates\n // `roles.some(...)`, and `[].some()` is always false, so EVERY caller is\n // denied. There is no legitimate empty-roles URL operation: public ops use\n // `APP_PUBLIC`, anonymous ops use `APP_ANONYMOUS`, user-self ops use\n // `APP_USER` (row ownership is enforced separately by the scope authorizer).\n // Catch the mistake at config-build time instead of shipping a dead endpoint.\n // (INTERNAL_CALL / REPOSITORY_ONLY variants are exempt — not URL-bearing, so\n // this loop never sees them; their empty roles are inert.)\n if (!variant.roles || variant.roles.length === 0) {\n throw createConfigurationError(\n `Operation '${operation}' has a URL-bearing (${variantType}) variant with an empty roles array. ` +\n `An empty roles array is fail-CLOSED: the authorization gate evaluates roles.some(...), which is ` +\n `always false for [], so every caller is denied (403). Specify at least one role — e.g. ` +\n `CORE_APP_ROLES.APP_USER (user-self / any authenticated user), CORE_APP_ROLES.APP_PUBLIC (public), ` +\n `CORE_APP_ROLES.APP_ANONYMOUS (anonymous), or the appropriate ORG/APP role.`,\n );\n }\n if (variant.variantKey) {\n assertOperationPathKeySegment(variant.variantKey, 'variantKey', String(operation));\n }\n if (variant.variantKey && RESERVED_OPERATION_VARIANT_KEYS.has(variant.variantKey.toLowerCase())) {\n throw createConfigurationError(\n `Operation '${operation}' cannot use reserved variantKey '${variant.variantKey}'`,\n );\n }\n if (variant.variantKey && AUTO_OPERATION_VARIANT_KEYS.has(variant.variantKey.toLowerCase() as typeof OPERATION_VARIANT_KEY.SUMMARY | typeof OPERATION_VARIANT_KEY.CONTEXT)\n && variant.variantKey !== variant.variantKey.toLowerCase()\n ) {\n throw createConfigurationError(\n `Operation '${operation}' must use canonical lowercase variantKey '${variant.variantKey.toLowerCase()}' for generated variant semantics`,\n );\n }\n if (variant.variantKey && AUTO_OPERATION_VARIANT_KEYS.has(variant.variantKey.toLowerCase() as typeof OPERATION_VARIANT_KEY.SUMMARY | typeof OPERATION_VARIANT_KEY.CONTEXT)\n && !isDataModeVariantKeyAllowedForOperation(String(operation), variant)\n ) {\n throw createConfigurationError(\n `Operation '${operation}' cannot use data-mode variantKey '${variant.variantKey}' unless it is READ, LIST, or SEARCH-like`,\n );\n }\n }\n }\n }\n\n const urlisableVariants = config.variants.filter((variant) => isUrlisableOperationVariantType(variant.variantType));\n const explicitUrlisableDefaults = urlisableVariants.filter((variant) => variant.isDefault === true);\n if (urlisableVariants.length > 1) {\n if (explicitUrlisableDefaults.length === 0) {\n throw createConfigurationError(\n `Operation '${operation}' with multiple URL-bearing variants must have exactly one with isDefault=true`,\n );\n }\n if (explicitUrlisableDefaults.length > 1) {\n throw createConfigurationError(\n `Operation '${operation}' cannot declare more than one default URL-bearing variant across API_CALL and API_CALL_WITH_CALLBACK`,\n );\n }\n }\n // A single URL-bearing variant is the URL default UNLESS the author explicitly set\n // `isDefault: false` — mirrors `determineOperationVariantDefault` Rule 1 so the stored\n // `isOperationDefault` flag and this validation set never disagree. When the opt-out is\n // honored, the sole `isDefault: false` URL variant is treated as non-default here, which\n // correctly routes it through the \"non-default URL-bearing variant must declare a\n // variantKey\" check below — a sole opted-out URL variant with no variantKey would\n // otherwise be unresolvable by BOTH the default and the keyed path resolver.\n const urlisableDefaultVariants = urlisableVariants.length === 1\n ? urlisableVariants.filter((variant) => variant.isDefault !== false)\n : explicitUrlisableDefaults;\n\n const urlisableVariantKeys = new Set<string>();\n for (const variant of urlisableVariants) {\n const willBeDefault = urlisableDefaultVariants.includes(variant);\n\n if (variant.variantKey) {\n const normalizedVariantKey = variant.variantKey.toLowerCase();\n if (urlisableVariantKeys.has(normalizedVariantKey)) {\n throw createConfigurationError(\n `Operation '${operation}' cannot reuse variantKey '${variant.variantKey}' across URL-bearing variants`,\n );\n }\n urlisableVariantKeys.add(normalizedVariantKey);\n }\n\n if (willBeDefault) {\n continue;\n }\n\n if (!variant.variantKey) {\n throw createConfigurationError(\n `Operation '${operation}' cannot declare a non-default URL-bearing variant without a variantKey`,\n );\n }\n\n }\n\n // Process parent resource access scope strategy overrides for this operation\n const operationResourceRelationships = processParentResourceAccessScopeStrategyOverrides(\n processedResourceRelationships,\n availableParentResourceTypes,\n config.parentResourceAccessScopeStrategyOverrides || [],\n operation as string\n );\n\n // Process user notifications using helper function\n const userNotifications = processUserNotifications(\n config.userNotifications || [],\n resourceIdentifier,\n operation,\n resourcePrimaryScope\n );\n\n // Process m2mNotifications using helper function\n const m2mNotifications = processM2MNotifications(\n config.m2mNotifications || [],\n resourceIdentifier,\n operation\n );\n\n // Process each variant to create flattened operations\n config.variants.forEach((variantParams, variantIndex) => {\n // Note: Cascading delete is now handled via childOperations.lifecycle.onParentDelete on relationships\n // No longer processed at operation variant level\n\n // Determine if this variant is the operation default. URL-bearing\n // variants share one default/key identity space across API and callback\n // transports; non-URL transports keep variant-type-local defaults.\n const variantsOfSameType = variantsByType.get(variantParams.variantType) || [];\n const isOperationDefault = isUrlisableOperationVariantType(variantParams.variantType)\n ? determineOperationVariantDefault(urlisableVariants, variantParams)\n : determineOperationVariantDefault(variantsOfSameType, variantParams);\n\n // Determine effective operation for DTO derivation\n // For custom operations, use resourceOperationLike if it maps to CREATE or UPDATE\n const isCustomOperation = !coreOperations.includes(operation as any);\n const effectiveOperationForDto = isCustomOperation\n ? (variantParams.resourceOperationLike || operation)\n : operation;\n\n // ── Dev-time guardrail: custom op borrowing a NON-object envelope verb ──\n // A custom operation that borrows DELETE / DELETE_MANY / COUNT via\n // `resourceOperationLike` inherits that verb's DEFAULT response envelope\n // (`{ id, deletedAt? }` / `{ deletedIds, deletedCount }` / `{ count }`) as\n // its responseDto AND internalDto. That envelope is almost never what a\n // custom op actually returns, so at runtime the service output fails\n // `transformOutput`'s `internalDto.parse` → HTTP 500\n // (`service_resource_transformation_failed`). Warn — do NOT throw: a custom\n // op that legitimately returns a bare id / `{ count }` is valid, so this is\n // a misconfiguration signal, not an invariant. Surfacing it at registry\n // build beats discovering it on first invocation.\n //\n // Scope note: this deliberately does NOT cover UPDATE / CREATE / READ\n // borrowing. Those verbs' default response IS the resource object, which is\n // correct for the many custom mutation ops that return the mutated entity —\n // a static check cannot tell those from the (rarer) ones that return a\n // non-resource shape (e.g. `{ url }`, `{ message }`). Those are guarded by\n // an authored `customResponseDto` + the built-operation DTO tests instead.\n if (isCustomOperation && !(variantParams as { customResponseDto?: unknown }).customResponseDto\n && (\n variantParams.resourceOperationLike === CoreResourceOperation.DELETE\n || variantParams.resourceOperationLike === CoreResourceOperation.DELETE_MANY\n || variantParams.resourceOperationLike === CoreResourceOperation.COUNT\n )\n ) {\n console.warn(\n `[wildo:resource-config] Custom operation \"${String(resourceIdentifier)}.${String(operation)}\" `\n + `borrows ${String(variantParams.resourceOperationLike)} via resourceOperationLike but declares no `\n + `customResponseDto. It will inherit that verb's default response envelope, which almost never `\n + `matches a custom operation's output and will fail output validation (HTTP 500) at invocation. `\n + `Declare a customResponseDto matching the operation's true return shape.`,\n );\n }\n\n // Auto-derive requestDto from decorators if not explicitly provided\n const derivedRequestDto = deriveRequestDto(\n effectiveOperationForDto as string,\n effectiveMainSchema,\n variantParams.requestDto\n );\n\n // Auto-derive responseDto based on operation type\n // - LIST: use derivedSummarySchema (only isSummaryField fields)\n // - READ/CREATE/UPDATE: use effectiveMainSchema (full object)\n // - DELETE: returns just the deleted ID (handled elsewhere)\n // - customResponseDto overrides if provided\n const deriveResponseDto = (): z.ZodTypeAny => {\n if ((variantParams as any).customResponseDto) {\n return (variantParams as any).customResponseDto;\n }\n if (operation === CoreResourceOperation.LIST\n || (variantParams as any).resourceOperationLike === CoreResourceOperation.LIST) {\n return derivedSummarySchema;\n }\n if (operation === CoreResourceOperation.SEARCH\n || (variantParams as any).resourceOperationLike === CoreResourceOperation.SEARCH) {\n return derivedSummarySchema;\n }\n return effectiveMainSchema;\n };\n\n // Derive the responseDto for this operation (temporary, will be replaced by buildAllOperationDtos)\n const operationResponseDto = deriveResponseDto();\n\n // Create base operation fields shared by all operation types\n // Note: DTOs (requestDto, responseDto, summaryDto, contextDto, internalDto, repositoryDto)\n // will be pre-computed by buildAllOperationDtos() after all operations are created.\n // We set temporary DTOs here for type compatibility, but they will be replaced.\n const baseOperationFields = {\n isDisabled: params.isDisabled ?? false,\n mainSchema: effectiveMainSchema,\n resourcePrimaryScope,\n resourceIdentifier,\n resourceFieldIdentifier,\n resourceRelationships: operationResourceRelationships,\n isSystemResource,\n operationIdentifier: operation,\n isOperationDefault,\n serviceRuntimeMode: config.serviceRuntimeMode || ResourceOperation_ServiceRuntimeMode.INLINE,\n requestDto: derivedRequestDto, // Temporary - will be replaced by buildAllOperationDtos\n responseDto: operationResponseDto, // Temporary - will be replaced by buildAllOperationDtos\n // When the variant supplied an explicit `requestDto`, it is an author-owned\n // contract the DTO builder must preserve verbatim. Otherwise `derivedRequestDto`\n // is an auto-derived TEMPORARY placeholder built from the base object (before\n // inheritance is known), so the builder must rebuild it — as a per-variant union\n // for inheritance resources. See `hasCustomRequestDto` in the operation schema.\n hasCustomRequestDto: !!(variantParams as any).requestDto,\n hasCustomResponseDto: !!(variantParams as any).customResponseDto,\n notificationBadgeOperations: config.notificationBadgeOperations || [],\n userNotifications,\n m2mNotifications,\n // Carried verbatim rather than normalized: it is one authored object with no derived\n // parts, unlike the notification families above, which the factory stamps with scope and\n // identifier. `undefined` means the operation consumes no metered product.\n recordsUsage: config.recordsUsage,\n // Fields from ResourceConfiguration_OperationVariant_Base\n variantType: variantParams.variantType,\n resourceOperationLike: variantParams.resourceOperationLike,\n generatedOperation: variantParams.generatedOperation,\n // Forwarded here rather than inside the collection-view enrichment below, which is an\n // explicit ALLOW-LIST reached only by LIST/SEARCH-shaped variants. Copying it there would\n // make a `collectionExport` declared on the wrong verb vanish silently; copying it here\n // lets it reach `createGeneratedCollectionExportOperations`, which refuses it by name.\n collectionExport: (variantParams as any).collectionExport,\n requiredFeatures: normalizeRequiredFeatures(variantParams.requiredFeatures),\n riskLevel: variantParams.riskLevel || ResourceOperationRiskLevel.LOW,\n // Forwarded for the same reason as the flags below: the frontend resources client reads it\n // off the RUNTIME operation, so dropping it here would leave a declared long-run timeout\n // silently unapplied and the 30s default cutting the request (issue #237).\n clientRequestTimeoutMs: variantParams.clientRequestTimeoutMs,\n roles: variantParams.roles,\n // Forwarded, not defaulted: the startup guard and the request-time refusal both read it\n // off the RUNTIME operation. This block re-lists variant fields rather than spreading\n // them, so a new variant field that is not added here is silently dropped between\n // authoring and runtime.\n unimplementedAcknowledgement: variantParams.unimplementedAcknowledgement,\n // Forwarded for the same reason: `enforceStepUpAuth` reads it off the RUNTIME operation, so\n // an unforwarded flag would leave the authored requirement silently unenforced — the exact\n // failure mode the flag exists to prevent.\n requiresStepUpAuthentication: variantParams.requiresStepUpAuthentication,\n admitsCrossTenantPlatformAdministration: variantParams.admitsCrossTenantPlatformAdministration,\n // Same forwarding obligation as its cross-tenant sibling: the authorizer reads this off the\n // RUNTIME operation, so dropping it here would silently re-close the admin surface.\n admitsCrossSubjectUserAdministration: variantParams.admitsCrossSubjectUserAdministration,\n // Forwarded for the same reason again: the post-commit audit emission reads it off the\n // RUNTIME operation. Dropping it would either lose an authored below-floor opt-in (a silent\n // audit gap) or lose an authored suppression (a duplicate row next to a purpose-built event).\n auditableEvent: variantParams.auditableEvent,\n mcp: variantParams.mcp,\n customServiceImplementationModes: variantParams.customServiceImplementationModes || [],\n basicPrefixOperation: variantParams.basicPrefixOperation,\n // Travels WITH `basicPrefixOperation` — it declares which of that hook's fields survive the\n // repository's strict re-parse even when the caller also sent them. Dropping it here would\n // silently reduce the hook to the added-key inference it exists to correct.\n authoritativeFields: variantParams.authoritativeFields,\n // Forwarded for the same reason as its siblings above: the write-integrity guard reads the\n // per-variant reference POLICY off the RUNTIME operation. Dropping it here degrades every\n // variant to the relationship's baseline membership — so an authored `qualifyingStatuses` /\n // `requiredRoles` / `false` would be silently inert while the config claims otherwise. (This\n // is not hypothetical: it shipped that way once, and the e2e caught it as a PENDING and a\n // REVOKED partnership both admitting a share.)\n referenceConstraints: variantParams.referenceConstraints,\n };\n\n\n\n if (isUrlisableOperationVariantType(variantParams.variantType)) {\n const apiCallParams = variantParams as ResourceConfiguration_OperationVariant_BuilderParameters<TMainSchema> & {\n variantType: ResourceOperationVariantType.API_CALL | ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n };\n const isCallbackVariant = apiCallParams.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK;\n const callbackParams = apiCallParams as {\n callbackUrl?: string;\n callbackTimeout?: number;\n callbackRetryAttempts?: number;\n };\n\n // Determine if this is a custom operation and get the operation to check\n const isCustomOperation = !coreOperations.includes(operation as any);\n const operationToCheck = isCustomOperation ? apiCallParams.resourceOperationLike : operation;\n\n // Validate bulk operation business rules - check against the relevant operation\n const haveBulkOperation = apiCallParams.haveBulkOperation || false;\n if (haveBulkOperation && (operationToCheck === CoreResourceOperation.READ || operationToCheck === CoreResourceOperation.LIST)) {\n throw createConfigurationError(`Operation '${operation}' cannot have bulk operations (read and list are not bulkable)`);\n }\n const tokenStateSideEffects = [\n ...(apiCallParams.tokenGeneration ? ['tokenGeneration'] : []),\n ...(apiCallParams.tokenRevocation ? ['tokenRevocation'] : []),\n ];\n if (\n tokenStateSideEffects.length > 0\n && (\n haveBulkOperation\n || isTokenStateEffectUnsupportedOperation(operationToCheck)\n )\n ) {\n throw createConfigurationError(\n `Operation '${operation}' cannot combine collection/bulk result semantics with ${tokenStateSideEffects.join(' and ')}. `\n + 'Token generation and revocation each require one canonical related resource state; collection, aggregate, and '\n + 'bulk operations do not expose a single related resource identity. Split the token side effect into a singular '\n + 'operation or remove the collection/bulk variant.',\n );\n }\n if (apiCallParams.tokenRevocation && operationToCheck === CoreResourceOperation.CREATE\n ) {\n throw createConfigurationError(\n `Operation '${operation}' cannot revoke tokens before a CREATE operation because no current resource state exists. `\n + 'Move token revocation to an operation that addresses an existing resource.',\n );\n }\n\n // Determine HTTP verb - for custom operations, use resourceOperationLike\n let httpVerb: HttpMethod;\n if (isCustomOperation) {\n // For custom operations, resourceOperationLike is mandatory and we use its HTTP verb\n if (!apiCallParams.resourceOperationLike) {\n throw createConfigurationError(`Operation '${operation}' is a custom operation and must specify resourceOperationLike`);\n }\n httpVerb = getDefaultHttpVerbForOperation(apiCallParams.resourceOperationLike);\n } else {\n // For core operations, use the operation itself\n httpVerb = getDefaultHttpVerbForOperation(operation);\n }\n\n\n\n // ── Build-time validation for token configs ──\n if (apiCallParams.tokenGeneration) {\n validateTokenGenerationConfig(\n apiCallParams.tokenGeneration,\n resourceIdentifier as string,\n operation as string,\n );\n }\n if (apiCallParams.tokenRevocation) {\n validateTokenRevocationConfig(\n apiCallParams.tokenRevocation,\n resourceIdentifier as string,\n operation as string,\n );\n }\n\n const apiCallOperationFields = {\n ...baseOperationFields,\n httpVerb,\n isApiKeyAccessDisabled: apiCallParams.isApiKeyAccessDisabled || false,\n isBulkOperation: false, // Normal operation\n tokenAuthentication: apiCallParams.tokenAuthentication,\n tokenGeneration: apiCallParams.tokenGeneration,\n tokenRevocation: apiCallParams.tokenRevocation,\n // Per-endpoint rate-limit policy: forwarded from the\n // builder params to the resolved operation. Read at runtime by\n // `RateLimitBackendService.checkPolicyForVariant` at the controller\n // pre-flight seam. `undefined` means the global HTTP limiter is the\n // only gate for this route.\n rateLimit: apiCallParams.rateLimit,\n enabledCondition: apiCallParams.enabledCondition,\n isDefault: apiCallParams.isDefault,\n variantKey: apiCallParams.variantKey,\n ...(isCallbackVariant ? {\n callbackUrl: callbackParams.callbackUrl,\n callbackTimeout: callbackParams.callbackTimeout ?? 300,\n callbackRetryAttempts: callbackParams.callbackRetryAttempts ?? 3,\n } : {}),\n };\n\n // ── Collection-view enrichment ──────────────────────────────────\n // When an operation is SEARCH-like or LIST-like (by identity or resourceOperationLike),\n // extract collection-view fields from the variant params and compute derived schemas.\n const isSearchLike = operation === CoreResourceOperation.SEARCH\n || (variantParams as any).resourceOperationLike === CoreResourceOperation.SEARCH;\n const isListLike = operation === CoreResourceOperation.LIST\n || (variantParams as any).resourceOperationLike === CoreResourceOperation.LIST;\n\n if (isSearchLike) {\n const pageSize = (variantParams as any).pageSize ?? 20;\n const isSearchable = (variantParams as any).isSearchable !== false;\n const searchableFields = (variantParams as any).searchableFields || [];\n const searchableOptions = (variantParams as any).searchableOptions || { caseSensitive: false, fullMatchOnly: false };\n const rawFilterFields = (variantParams as any).filterFields || {};\n const sortFields = (variantParams as any).sortFields || [];\n const maxPaginatedResultPerPageLimit = (variantParams as any).maxPaginatedResultPerPageLimit || 50;\n\n const filterFields: Record<string, PrimitiveZodType> = {};\n Object.entries(rawFilterFields).forEach(([key, value]) => {\n if (typeof value !== 'function') {\n filterFields[key] = value as PrimitiveZodType;\n }\n });\n\n const searchQueryRequestSchema = createResourceSearchQueryRequestSchema({\n filterFields,\n allowedSortFields: sortFields,\n pagination: true,\n // The SAME value the response schema below is built from. That equality is the point:\n // request, repository and response must agree on one ceiling.\n maxPaginatedResultPerPageLimit\n });\n\n const paginatedResponseSchema = createResourcePaginatedResponseSchema({\n dataSchema: derivedSummarySchema,\n validateArrayConstraints: true,\n maxResultsPerPageLimit: maxPaginatedResultPerPageLimit\n });\n\n Object.assign(apiCallOperationFields, {\n pageSize,\n isSearchable,\n searchableFields,\n searchableOptions,\n filterFields: rawFilterFields,\n sortFields,\n maxPaginatedResultPerPageLimit,\n searchQueryRequestSchema,\n responseDto: paginatedResponseSchema,\n hasCustomResponseDto: false,\n });\n }\n\n if (isListLike) {\n const listEnrichment: Record<string, unknown> = {\n pageSize: (variantParams as any).pageSize ?? 20,\n searchEnabled: (variantParams as any).searchEnabled ?? true,\n filtersEnabled: (variantParams as any).filtersEnabled ?? true,\n // LIST has one pagination authority. Keep the effective ceiling on the resolved\n // operation so request/response DTO construction, repositories, auto-generated\n // SUMMARY/CONTEXT variants and API-reference projection all observe the same value.\n maxPaginatedResultPerPageLimit: (variantParams as any).maxPaginatedResultPerPageLimit ?? 100,\n };\n if ((variantParams as any).filterFields !== undefined) {\n listEnrichment.filterFields = (variantParams as any).filterFields;\n }\n if ((variantParams as any).sortFields !== undefined) {\n listEnrichment.sortFields = (variantParams as any).sortFields;\n }\n Object.assign(apiCallOperationFields, listEnrichment);\n }\n // ── End collection-view enrichment ──────────────────────────────\n\n // Add normal operation\n operations.push(apiCallOperationFields as ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>);\n\n // Add bulk operation if enabled\n if (haveBulkOperation) {\n const bulkDto = (() => {\n if (operationToCheck === CoreResourceOperation.CREATE) {\n return apiCallOperationFields.requestDto && apiCallOperationFields.requestDto !== z.object({})\n ? z.object({\n data: z.array(apiCallOperationFields.requestDto)\n })\n : z.object({\n data: z.array(z.object({}))\n });\n }\n\n if (apiCallOperationFields.requestDto instanceof z.ZodObject) {\n return Resources_BulkOperationBaseSchema.extend(\n getZodObjectShape(apiCallOperationFields.requestDto)\n );\n }\n\n return apiCallOperationFields.requestDto && apiCallOperationFields.requestDto !== z.object({})\n ? Resources_BulkOperationBaseSchema.and(apiCallOperationFields.requestDto)\n : Resources_BulkOperationBaseSchema;\n })();\n\n const bulkOperationFields = {\n ...apiCallOperationFields,\n isBulkOperation: true,\n isOperationDefault: false, // Bulk operations are never default\n requestDto: bulkDto\n };\n\n operations.push(bulkOperationFields as ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>);\n }\n\n } else {\n // Handle other variant types (CronJob, BatchJob, InternalCall, RepositoryOnly)\n const { variantType, ...specificFields } = variantParams; // Extract variantType and get rest\n\n const nonApiCallOperation = {\n ...baseOperationFields,\n ...specificFields\n };\n\n operations.push(nonApiCallOperation as ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>);\n }\n });\n\n // ========================================\n // PROCESS AUTO-VARIANTS FOR READ AND LIST\n // ========================================\n\n // Only process auto-variants for READ and LIST core operations\n if (operation === CoreResourceOperation.READ || operation === CoreResourceOperation.LIST) {\n // Reuse the flattened default URL-bearing operation so auto-variants inherit the same\n // resolved default identity as the rest of the resource config.\n const defaultApiCallVariant = [...operations].reverse().find((candidate) => (\n candidate.operationIdentifier === operation\n && isUrlisableOperationVariantType(candidate.variantType)\n && candidate.isOperationDefault === true\n && !('isBulkOperation' in candidate && candidate.isBulkOperation === true)\n )) as (\n ResourceConfiguration_Operation_ApiCall<TCustomOperationEnum, TCoreOperationEnum, TMainSchema> |\n Extract<\n ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n { variantType: ResourceOperationVariantType.API_CALL_WITH_CALLBACK }\n >\n ) | undefined;\n\n if (!defaultApiCallVariant) {\n // Skip auto-variants if no default variant exists\n continue;\n }\n\n const defaultListCollectionFields = defaultApiCallVariant as typeof defaultApiCallVariant & CollectionViewFields_List;\n\n // Check which variants already exist\n const existingVariantKeys = new Set(\n operations.filter((candidate) => (\n candidate.operationIdentifier === operation\n && isUrlisableOperationVariantType(candidate.variantType)\n && candidate.variantKey\n && !('isBulkOperation' in candidate && candidate.isBulkOperation === true)\n ))\n .map((candidate) => candidate.variantKey!.toLowerCase())\n );\n\n // Helper to create auto-variant operation\n // Note: DTOs will be pre-computed by buildAllOperationDtos() after all operations are created.\n // We set temporary DTOs here for type compatibility, but they will be replaced.\n const createAutoVariantOperation = (\n variantKey: typeof OPERATION_VARIANT_KEY.SUMMARY | typeof OPERATION_VARIANT_KEY.CONTEXT,\n responseDto: z.ZodTypeAny,\n isDefault: boolean\n ): ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema> => {\n const baseOperationFields = {\n isDisabled: params.isDisabled ?? false,\n mainSchema: effectiveMainSchema,\n resourcePrimaryScope,\n resourceIdentifier,\n resourceFieldIdentifier,\n resourceRelationships: operationResourceRelationships,\n isSystemResource,\n operationIdentifier: operation,\n isOperationDefault: false, // Auto-variants are never operation default\n serviceRuntimeMode: config.serviceRuntimeMode || ResourceOperation_ServiceRuntimeMode.INLINE,\n requestDto: defaultApiCallVariant.requestDto || deriveRequestDto(operation as string, effectiveMainSchema, undefined), // Temporary - will be replaced by buildAllOperationDtos\n // Forwarded for the same reason as `unimplementedAcknowledgement` below: an auto-variant\n // is a projection of the default variant, so it inherits that variant's request contract\n // and must report the same provenance. Dropping it would make a projection of an\n // AUTHORED contract look auto-derived to the request-contract-breadth guard.\n hasCustomRequestDto: defaultApiCallVariant.hasCustomRequestDto ?? !!defaultApiCallVariant.requestDto,\n responseDto, // Temporary - will be replaced by buildAllOperationDtos\n notificationBadgeOperations: config.notificationBadgeOperations || [],\n userNotifications,\n m2mNotifications,\n variantType: defaultApiCallVariant.variantType,\n resourceOperationLike: defaultApiCallVariant.resourceOperationLike,\n requiredFeatures: normalizeRequiredFeatures(defaultApiCallVariant.requiredFeatures),\n riskLevel: defaultApiCallVariant.riskLevel || ResourceOperationRiskLevel.LOW,\n // Inherited like riskLevel: an auto-variant is a projection of the default variant. The\n // read-shaped projections are unlikely to need it, but inheriting keeps \"projection of\n // the default\" a single consistent rule rather than a per-field accident.\n clientRequestTimeoutMs: defaultApiCallVariant.clientRequestTimeoutMs,\n roles: defaultApiCallVariant.roles, // Inherit roles from default variant\n // Inherited for the same reason as roles: an auto-variant is a projection of the\n // default variant, so if the default is a known implementation gap its SUMMARY /\n // CONTEXT derivatives are equally unserviceable and must refuse identically.\n unimplementedAcknowledgement: defaultApiCallVariant.unimplementedAcknowledgement,\n // Inherited for the same reason: an auto-variant is a projection of the default variant,\n // so a SUMMARY / CONTEXT derivative of a step-up-gated operation must demand the same\n // proof. (Today the auto-variants are read-shaped and `enforceStepUpAuth` exempts reads\n // anyway — inheriting keeps that a property of the exemption list rather than an accident\n // of this projection.)\n requiresStepUpAuthentication: defaultApiCallVariant.requiresStepUpAuthentication,\n admitsCrossTenantPlatformAdministration: defaultApiCallVariant.admitsCrossTenantPlatformAdministration,\n // Inherited for the same reason as the cross-tenant flag: an auto-variant is a PROJECTION of\n // the default operation and must make the same addressing claim, or it would refuse the very\n // subjects the operation it projects is admitted to administer.\n admitsCrossSubjectUserAdministration: defaultApiCallVariant.admitsCrossSubjectUserAdministration,\n // Inherited for the same reason: an auto-variant is a projection of the default variant,\n // so it must make the same audit claim. Inheriting a `suppressGenericEvent` matters most —\n // the purpose-built event that supersedes the default covers its projections too, and a\n // projection that dropped the suppression would write the duplicate row the flag prevents.\n auditableEvent: defaultApiCallVariant.auditableEvent,\n mcp: defaultApiCallVariant.mcp, // Inherit MCP exposure from default variant (non-default variants aren't MCP-enumerated anyway)\n customServiceImplementationModes: defaultApiCallVariant.customServiceImplementationModes || [],\n basicPrefixOperation: defaultApiCallVariant.basicPrefixOperation,\n // Inherited alongside the hook itself — an auto-variant that ran the prefix without its\n // ownership declaration would drop the very field the hook exists to force.\n authoritativeFields: defaultApiCallVariant.authoritativeFields,\n // Inherited for the same reason as `roles`: an auto-variant is a PROJECTION of the default\n // variant, so it must confine a written reference exactly as the operation it projects does.\n // (Read-shaped auto-variants write nothing today, so this is inert for them — inheriting\n // keeps that a property of what they DO rather than an accident of this projection.)\n referenceConstraints: defaultApiCallVariant.referenceConstraints,\n httpVerb: defaultApiCallVariant.httpVerb,\n isApiKeyAccessDisabled: defaultApiCallVariant.isApiKeyAccessDisabled || false,\n isBulkOperation: false,\n tokenAuthentication: defaultApiCallVariant.tokenAuthentication,\n tokenGeneration: defaultApiCallVariant.tokenGeneration,\n tokenRevocation: defaultApiCallVariant.tokenRevocation,\n // Auto-variants (READ.summary, READ.context, LIST.summary, …)\n // inherit the default variant's rate-limit policy by design — a\n // single declaration on the default URL-bearing variant covers all\n // derived auto-variants. Authors who need a per-variant override\n // declare the variant explicitly instead of relying on auto-generation.\n rateLimit: defaultApiCallVariant.rateLimit,\n enabledCondition: defaultApiCallVariant.enabledCondition,\n isDefault: isDefault,\n variantKey: variantKey,\n ...(operation === CoreResourceOperation.LIST ? {\n // A generated representation changes only the response DATA SHAPE. It remains the same\n // collection operation, so its query contract must be identical to the canonical default\n // variant. Otherwise selecting SUMMARY or CONTEXT silently removes filters, sorting or\n // the authored page ceiling from the public contract.\n pageSize: defaultListCollectionFields.pageSize,\n searchEnabled: defaultListCollectionFields.searchEnabled,\n filtersEnabled: defaultListCollectionFields.filtersEnabled,\n filterFields: defaultListCollectionFields.filterFields,\n sortFields: defaultListCollectionFields.sortFields,\n maxPaginatedResultPerPageLimit: defaultListCollectionFields.maxPaginatedResultPerPageLimit,\n } : {}),\n ...(defaultApiCallVariant.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK ? {\n callbackUrl: defaultApiCallVariant.callbackUrl,\n callbackTimeout: defaultApiCallVariant.callbackTimeout,\n callbackRetryAttempts: defaultApiCallVariant.callbackRetryAttempts,\n } : {}),\n };\n\n // ── Build-time validation for auto-variant token configs ──\n if (defaultApiCallVariant.tokenGeneration) {\n validateTokenGenerationConfig(\n defaultApiCallVariant.tokenGeneration,\n resourceIdentifier as string,\n `${operation as string}.${variantKey}`,\n );\n }\n if (defaultApiCallVariant.tokenRevocation) {\n validateTokenRevocationConfig(\n defaultApiCallVariant.tokenRevocation,\n resourceIdentifier as string,\n `${operation as string}.${variantKey}`,\n );\n }\n\n return baseOperationFields as ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>;\n };\n\n // Generate READ.summary variant\n if (operation === CoreResourceOperation.READ && enableReadSummary && !existingVariantKeys.has(OPERATION_VARIANT_KEY.SUMMARY)) {\n const summaryResponseDto = derivedSummarySchema;\n operations.push(createAutoVariantOperation(OPERATION_VARIANT_KEY.SUMMARY, summaryResponseDto, false));\n }\n\n // Generate READ.context variant\n if (operation === CoreResourceOperation.READ && enableReadContext && !existingVariantKeys.has(OPERATION_VARIANT_KEY.CONTEXT)) {\n const contextResponseDto = effectiveMainSchema; // Full schema for context\n operations.push(createAutoVariantOperation(OPERATION_VARIANT_KEY.CONTEXT, contextResponseDto, false));\n }\n\n // Generate LIST.summary variant\n if (operation === CoreResourceOperation.LIST && enableListSummary && !existingVariantKeys.has(OPERATION_VARIANT_KEY.SUMMARY)) {\n const summaryResponseDto = createResourcePaginatedResponseSchema({\n dataSchema: derivedSummarySchema,\n validateArrayConstraints: true,\n maxResultsPerPageLimit: defaultListCollectionFields.maxPaginatedResultPerPageLimit,\n });\n operations.push(createAutoVariantOperation(OPERATION_VARIANT_KEY.SUMMARY, summaryResponseDto, false));\n }\n\n // Generate LIST.context variant\n if (operation === CoreResourceOperation.LIST && enableListContext && !existingVariantKeys.has(OPERATION_VARIANT_KEY.CONTEXT)) {\n const contextResponseDto = createResourcePaginatedResponseSchema({\n dataSchema: effectiveMainSchema,\n validateArrayConstraints: true,\n maxResultsPerPageLimit: defaultListCollectionFields.maxPaginatedResultPerPageLimit,\n });\n operations.push(createAutoVariantOperation(OPERATION_VARIANT_KEY.CONTEXT, contextResponseDto, false));\n }\n }\n }\n\n // ========================================\n // CROSS-OPERATION TOKEN VALIDATION (E1)\n // ========================================\n\n // Detect invalid pairing: tokenGeneration with consumeAt:EXCHANGE + tokenAuthentication with ADDITIVE policy\n // When token is consumed at exchange, no consumable token value is carried into the session,\n // so ADDITIVE operations that require the token will silently fail.\n const generatedTokenTypes = new Map<string, 'EXCHANGE' | 'TARGET_OPERATION'>();\n const additiveTokenTypes = new Set<string>();\n\n for (const op of operations) {\n if ('tokenGeneration' in op && op.tokenGeneration?.createsOneOffSession && op.tokenGeneration.consumeAt) {\n generatedTokenTypes.set(op.tokenGeneration.tokenType as string, op.tokenGeneration.consumeAt);\n }\n if ('tokenAuthentication' in op && op.tokenAuthentication?.policy === TokenAuthenticationPolicy.ADDITIVE) {\n for (const t of op.tokenAuthentication.types) {\n additiveTokenTypes.add(t as string);\n }\n }\n }\n\n for (const [tokenType, consumeAt] of generatedTokenTypes) {\n if (consumeAt === 'EXCHANGE' && additiveTokenTypes.has(tokenType)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] tokenType '${tokenType}': consumeAt is 'EXCHANGE' but another operation ` +\n `uses this tokenType with ADDITIVE policy. EXCHANGE consumes the token before the session starts, ` +\n `so no token value will be available for ADDITIVE operations. Use 'TARGET_OPERATION' instead.`,\n );\n }\n }\n\n // ========================================\n // BUILD FINAL RESULT\n // ========================================\n\n // Build the final resource configuration to pass to buildAllOperationDtos\n // W7.3a: Warn if isAnonymizable but no operation has APP_ANONYMOUS role\n if (isAnonymizable) {\n const hasAnonymousRole = operations.some(op => op.roles.includes('APP_ANONYMOUS'));\n if (!hasAnonymousRole) {\n console.warn(\n `[${resourceIdentifier}] isAnonymizable: true but no operation has APP_ANONYMOUS in roles. ` +\n `Anonymous users won't be able to access any operation on this resource.`\n );\n }\n }\n\n operations.push(\n ...createGeneratedRelationshipBulkOperations(\n operations,\n relevantRelationships,\n resourceIdentifier,\n {\n ...coreResourceShared_FieldIdentifier,\n [resourceIdentifier]: resourceFieldIdentifier,\n }\n )\n );\n\n const generatedFileDiscoverySchema = ResourcesConfigOperationsDtosBuilderUtils.buildSchemaWithInheritance(\n effectiveMainSchema,\n inheritenceSchemaDefinition,\n );\n\n operations.push(\n ...createGeneratedFileRegenerateOperations({\n operations,\n resourceIdentifier,\n resourceFieldIdentifier,\n mainSchema: effectiveMainSchema,\n generatedFileDiscoverySchema,\n persistenceAdapter,\n })\n );\n\n // AFTER the file-regenerate companions, and over the same fully-assembled set: a generated\n // relationship-bulk operation is never a LIST/SEARCH, so ordering cannot change the outcome — but\n // deriving from the complete set means a future generated LIST would be covered without a second\n // call site to remember.\n operations.push(\n ...createGeneratedCollectionExportOperations({\n operations,\n resourceIdentifier,\n })\n );\n\n // ── Fail-closed guard: no anonymous BULK MUTATION (W7.3a hardening) ─────\n //\n // An anonymous caller may legitimately be granted single-record CREATE / READ\n // / LIST / UPDATE / DELETE (e.g. draft-notes lead capture), but a bulk MUTATION\n // (CREATE_MANY / UPDATE_MANY / DELETE_MANY) granted to `APP_ANONYMOUS` is an\n // unauthenticated mass-write surface — a whole-collection destructive footgun\n // no app should be able to author by accident. The framework provided ZERO\n // enforcement here (only a non-blocking \"isAnonymizable without any anon op\"\n // warning existed), so this fails closed at config-build time. Read-shaped\n // collection ops (LIST / SEARCH / COUNT) are intentionally NOT flagged —\n // anonymous listing of one's own anonymous rows is a supported pattern.\n //\n // Runs over the FULLY-assembled operation set (authored + generated\n // relationship-bulk + file-regenerate) so a generated bulk op that inherited\n // anonymous roles from its base is caught too. Zero violations exist today.\n for (const operation of operations) {\n // A resource op is a bulk MUTATION iff EITHER its identifier is a core bulk\n // verb (create_many / update_many / delete_many) OR it carries the\n // `isBulkOperation` flag. The flag is sufficient on its own: the factory\n // rejects `haveBulkOperation` on READ / LIST above (\"read and list are not\n // bulkable\"), so `isBulkOperation === true` is GUARANTEED to be a mutation —\n // it covers the opt-in bulk UPDATE/DELETE companions AND the generated\n // relationship-bulk ops (whose `operationIdentifier` is a relationship id,\n // not a core verb, so clause 1 alone would miss them). `operationIdentifier`\n // is the (core | custom) op union and `isBulkOperation` exists only on some\n // variants of the discriminated union — narrow with `in` and compare by\n // string value (enum members ARE their string values); the CronJob variant\n // carries neither.\n const isBulkMutation =\n isCoreBulkMutationOperation(operation.operationIdentifier)\n || ('isBulkOperation' in operation && operation.isBulkOperation === true);\n if (isBulkMutation && operation.roles.includes('APP_ANONYMOUS')) {\n throw createConfigurationError(\n `[${resourceIdentifier}] operation '${String(operation.operationIdentifier)}' grants APP_ANONYMOUS on a ` +\n `bulk MUTATION (create_many / update_many / delete_many). Unauthenticated mass-write is forbidden — ` +\n `anonymous access is only permitted on single-record operations (and read-shaped collection ops: ` +\n `list / search / count). Remove APP_ANONYMOUS from this operation's roles.`\n );\n }\n }\n\n // ── RESOLVABILITY half of the retention operation contract ──────────────\n //\n // The presence half ran with the other `retentionPolicy` validations above: it proved\n // UPDATE_MANY / READ / LIST are declared. Being DECLARED is not the same as being REACHABLE,\n // and the gap between the two is a config that boots green and breaks on the first erasure.\n //\n // All three retention primitives resolve their operation through\n // `ResourcesRegistryBackendService.getServiceOperationPathDefault`, which admits ONLY the\n // variant types in `SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES` and only when the variant is\n // the operation DEFAULT. `REPOSITORY_ONLY` is route-less exactly like `INTERNAL_CALL` — so it\n // is the natural-looking choice for \"the capability without a new HTTP surface\" — but it is\n // deliberately excluded there and served by the separate `getRepositoryOperationPathDefault`\n // transport. A `REPOSITORY_ONLY` UPDATE_MANY therefore satisfied the presence check and then\n // failed to resolve mid-erasure. That is not hypothetical: the `USERS` opt-in shipped it, every\n // config test passed, and only a completion review caught it.\n //\n // Runs HERE, not with the presence half, because `isOperationDefault` is computed by the\n // operations loop above (it is variant-type-LOCAL — a lone variant marked `isDefault: false`\n // yields NO default for its transport group, which this check must see). Reads the SAME\n // predicate the resolver applies, so a config this guard accepts is a config the resolver can\n // serve, by construction rather than by two lists agreeing.\n if (retentionPolicy?.mode) {\n for (const { operation: requiredOperation, primitive } of RETENTION_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS) {\n if (operations.some((candidate) => isServiceResolvableDefaultOperation(candidate, requiredOperation))) {\n continue;\n }\n\n const declaredVariants = operations\n .filter((candidate) => candidate.operationIdentifier === requiredOperation)\n .map((candidate) => `${candidate.variantType}${candidate.variantKey ? `:${candidate.variantKey}` : ''}` +\n `${candidate.isOperationDefault ? ' (default)' : ''}`);\n\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires ${requiredOperation} to be SERVICE-RESOLVABLE, but it ` +\n `declares no DEFAULT variant of an accepted type. Declared variants: ` +\n `[${declaredVariants.length > 0 ? declaredVariants.join(', ') : 'none'}]. The retention primitive ` +\n `${primitive} resolves this operation through getServiceOperationPathDefault, which accepts only ` +\n `[${SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES.join(', ')}] and only the operation default. ` +\n `REPOSITORY_ONLY is route-less but is served by the SEPARATE getRepositoryOperationPathDefault ` +\n `transport, so it passes the \"operation exists\" check and then FAILS TO RESOLVE the moment an ` +\n `erasure runs. Use ${ResourceOperationVariantType.INTERNAL_CALL} for a capability that must stay ` +\n `route-less (it is both route-less and service-resolvable), and make sure it is the default for ` +\n `its transport group — a lone variant marked \\`isDefault: false\\` leaves the group with NO default.`\n );\n }\n }\n\n const resourceConfig: ResourceConfiguration<TCustomOperationEnum, TCoreOperationEnum, TMainSchema> = {\n isDisabled: params.isDisabled ?? false,\n resourcePrimaryScope,\n resourceIdentifier,\n resourceFieldIdentifier,\n coreOperations,\n customOperation,\n mainSchema: effectiveMainSchema,\n resourceRelationships: processedResourceRelationships,\n inheritenceSchemaDefinition,\n persistenceAdapter,\n persistenceAdapterIsolation,\n httpApiBinding: resolvedHttpApiBinding,\n introspectionBinding,\n externalDataPipeline,\n isSystemResource,\n primaryKeyIdentifiesInitiator,\n systemAccessPolicy: effectiveSystemAccessPolicy,\n isAnonymizable,\n transpositionPolicy: isAnonymizable\n ? (transpositionPolicy ?? ResourceTranspositionPolicy.ADD)\n : ResourceTranspositionPolicy.ADD,\n // Normalize (mirror transpositionPolicy): the RESOLVED retentionPolicy is present IFF the resource\n // opted in. An absent `mode` is an opt-in-shaped opt-out that injects no marker\n // and derives no grants, so it must NOT ship a truthy resolved value — else a consumer doing\n // `if (config.retentionPolicy)` would treat a non-opted-in resource as retention-governed.\n retentionPolicy: retentionPolicy?.mode ? retentionPolicy : undefined,\n // Paired with `retentionPolicy` by the guards above, so these two are present together or not at all.\n dataSubjectPolicy: retentionPolicy?.mode ? dataSubjectPolicy : undefined,\n // Normalize (mirror retentionPolicy): the resolved portabilityPolicy is present IFF the\n // resource actually declared a default. An absent `defaultProvenance` is a policy-shaped\n // opt-out, and shipping a truthy-but-empty object would make an Art. 20 export believe a\n // default exists and silently include fields nobody classified.\n portabilityPolicy: portabilityPolicy?.defaultProvenance ? portabilityPolicy : undefined,\n operations: operations // Temporary - will be replaced\n };\n\n // Pre-compute all DTOs for each operation using buildAllOperationDtos\n // Note: Registry is empty for now - it's mainly used for cross-references in nested DTOs\n // If needed, the registry can be passed as a parameter to the factory function\n const resourceRegistry = new Map<ResourceType, any>();\n const operationsWithDtos = operations.map(operation =>\n ResourcesConfigOperationsDtosBuilderUtils.buildAllOperationDtos(\n operation,\n resourceConfig,\n resourceRegistry\n )\n );\n\n return {\n isDisabled: params.isDisabled ?? false,\n resourcePrimaryScope,\n resourceIdentifier,\n resourceFieldIdentifier,\n coreOperations,\n customOperation,\n mainSchema: effectiveMainSchema,\n resourceRelationships: processedResourceRelationships,\n inheritenceSchemaDefinition,\n persistenceAdapter,\n persistenceAdapterIsolation,\n httpApiBinding: resolvedHttpApiBinding,\n introspectionBinding,\n externalDataPipeline,\n isSystemResource,\n primaryKeyIdentifiesInitiator,\n systemAccessPolicy: effectiveSystemAccessPolicy,\n isAnonymizable,\n transpositionPolicy: isAnonymizable\n ? (transpositionPolicy ?? ResourceTranspositionPolicy.ADD)\n : ResourceTranspositionPolicy.ADD,\n // Normalize (mirror transpositionPolicy): resolved retentionPolicy present IFF opted-in — see the\n // internal resourceConfig object above for the full rationale.\n retentionPolicy: retentionPolicy?.mode ? retentionPolicy : undefined,\n // Paired with `retentionPolicy` by the guards above, so these two are present together or not at all.\n dataSubjectPolicy: retentionPolicy?.mode ? dataSubjectPolicy : undefined,\n // Normalize (mirror retentionPolicy): the resolved portabilityPolicy is present IFF the\n // resource actually declared a default. An absent `defaultProvenance` is a policy-shaped\n // opt-out, and shipping a truthy-but-empty object would make an Art. 20 export believe a\n // default exists and silently include fields nobody classified.\n portabilityPolicy: portabilityPolicy?.defaultProvenance ? portabilityPolicy : undefined,\n operations: operationsWithDtos\n };\n}\n"]}
1
+ {"version":3,"file":"resources-config.shared.factory.js","sourceRoot":"","sources":["../../../src/resources/resources-config.shared.factory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,uBAAuB,EAEvB,yBAAyB,EACzB,yBAAyB,EACzB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,YAAY,EACZ,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/J,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,6DAA6D,CAAC;AAC5G;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAClK,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,4BAA4B,EAC5B,qCAAqC,EACrC,8CAA8C,GAC/C,MAAM,wDAAwD,CAAC;AAKhE,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,OAAO,EAAE,+BAA+B,EAAE,yBAAyB,EAAE,MAAM,6DAA6D,CAAC;AACzI,OAAO,EACL,qBAAqB,EAKrB,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAEhC,6BAA6B,EAC7B,sCAAsC,EAStC,8BAA8B,EAG9B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EAGT,sCAAsC,GACvC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAgB,MAAM,qCAAqC,CAAC;AAChJ,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACnC,iCAAiC,EACjC,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,oCAAoC,EACpC,iCAAiC,EACjC,oBAAoB,EAEpB,8BAA8B,EAC9B,0CAA0C,EAC1C,mDAAmD,EACnD,oDAAoD,EACpD,kDAAkD,EAClD,qDAAqD,EACrD,iDAAiD,EACjD,oDAAoD,EAEpD,uCAAuC,EACvC,+BAA+B,EAC/B,2BAA2B,EAC5B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,yCAAyC,EAAE,MAAM,wDAAwD,CAAC;AACnH,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,gCAAgC,EAAE,qCAAqC,EAAE,MAAM,8CAA8C,CAAC;AACvI,OAAO,EAAE,0BAA0B,EAAgC,MAAM,yDAAyD,CAAC;AACnI,OAAO,EACL,mCAAmC,EACnC,0CAA0C,EAC1C,mCAAmC,GACpC,MAAM,8CAA8C,CAAC;AAEtD,mCAAmC;AACnC,gBAAgB;AAChB,mCAAmC;AAEnC;;;GAGG;AACH;;;;;;;;;;;;;;GAcG;AACH,SAAS,oCAAoC,CAC3C,MAAoB,EACpB,kBAA0B;IAE1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAW,CAAC;IAEnC,MAAM,IAAI,GAAG,CAAC,SAAmC,EAAE,IAAY,EAAE,UAAmB,EAAQ,EAAE;QAC5F,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO;QACjD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEvB,IAAI,CAAC,UAAU,IAAI,yBAAyB,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,YAAY,IAAI,2DAA2D;gBACjG,oGAAoG;gBACpG,gCAAgC,IAAI,mEAAmE;gBACvG,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,WAA2B,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC;IAEF,uFAAuF;IACvF,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,SAAS,GAAG,YAAY,CAAC,WAA2B,CAAC,IAAK,WAA4B,CAAC;QAC7F,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,WAA2B,EAAE,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,KAAa,CAAC,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,KAAa,CAAC,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,+BAA+B,CAAC,WAAyC;IAChF,OAAO,mCAAmC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gDAAgD,GAIhD;IACJ;QACE,SAAS,EAAE,qBAAqB,CAAC,WAAW;QAC5C,SAAS,EAAE,oBAAoB;QAC/B,GAAG,EAAE,sEAAsE;KAC5E;IACD;QACE,SAAS,EAAE,qBAAqB,CAAC,IAAI;QACrC,SAAS,EAAE,sBAAsB;QACjC,GAAG,EAAE,gGAAgG;KACtG;IACD;QACE,SAAS,EAAE,qBAAqB,CAAC,IAAI;QACrC,SAAS,EAAE,sBAAsB;QACjC,GAAG,EAAE,wFAAwF;KAC9F;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,mDAAmD,GAKnD;IACJ;QACE,UAAU,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;QACxC,SAAS,EAAE,sBAAsB;QACjC,GAAG,EAAE,uEAAuE;KAC7E;IACD;QACE,UAAU,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC;QAC/C,SAAS,EAAE,wCAAwC;QACnD,GAAG,EAAE,yFAAyF;KAC/F;IACD;QACE,UAAU,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,qBAAqB,CAAC,MAAM,CAAC;QAC7E,SAAS,EAAE,oBAAoB;QAC/B,GAAG,EAAE,iGAAiG;cAClG,2EAA2E;KAChF;CACF,CAAC;AAEF,iFAAiF;AACjF,SAAS,6BAA6B,CAAC,UAA4C;IACjF,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAa,EAAE,KAAa,EAAE,SAAiB;IACpF,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,wBAAwB,CAC5B,cAAc,SAAS,gBAAgB,KAAK,KAAK,KAAK,2DAA2D,CAClH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,yCAAyC,CAChD,UAAiB,EACjB,qBAA6C,EAC7C,kBAAgC,EAChC,2BAA2F;IAE3F,MAAM,wBAAwB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/D,+BAA+B,CAAC,SAAS,CAAC,WAAW,CAAC;WACnD,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,MAAM;WAC9D,iBAAiB,IAAI,SAAS;WAC9B,SAAS,CAAC,eAAe,KAAK,IAAI,CACtC,CAAC;IAEF,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,0GAA0G,wBAAwB,CAAC,MAAM,EAAE,CAClK,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,uBAAuB,CAAC,GAAG,wBAAwB,CAAC;IAE3D,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,mBAAmB,GAAU,EAAE,CAAC;IACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CACvC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CACrE,CAAC;IAEF,KAAK,MAAM,YAAY,IAAI,qBAAqB,EAAE,CAAC;QACjD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,4CAA4C,CAC1F,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,CAC5B,CAAC,eAAe,CAAC;QAClB,MAAM,cAAc,GAAG,qBAAqB,CAAC,gDAAgD,CAC3F,YAAY,EACZ,kBAAkB,CACnB,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,wCAAwC,CACxF,MAAM,EACN,iBAAiB,CAClB,CAAC;YAEF,IAAI,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,4CAA4C,mBAAmB,kDAAkD,CACxI,CAAC;YACJ,CAAC;YAED,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAEnD,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;gBACvB,QAAQ,MAAM,EAAE,CAAC;oBACf,KAAK,8BAA8B,CAAC,GAAG;wBACrC,OAAO,iDAAiD,CAAC;oBAC3D,KAAK,8BAA8B,CAAC,KAAK;wBACvC,OAAO,mDAAmD,CAAC;oBAC7D,KAAK,8BAA8B,CAAC,MAAM;wBACxC,OAAO,oDAAoD,CAAC;oBAC9D,KAAK,8BAA8B,CAAC,IAAI;wBACtC,OAAO,kDAAkD,CAAC;oBAC5D,KAAK,8BAA8B,CAAC,MAAM;wBACxC,OAAO,oDAAoD,CAAC;oBAC9D,KAAK,8BAA8B,CAAC,OAAO;wBACzC,OAAO,qDAAqD,CAAC;gBACjE,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YAEL,mBAAmB,CAAC,IAAI,CAAC;gBACvB,GAAG,uBAAuB;gBAC1B,mBAAmB;gBACnB,SAAS,EAAE,KAAK;gBAChB,kBAAkB,EAAE,KAAK;gBACzB,eAAe,EAAE,IAAI;gBACrB,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;gBACxD,UAAU;gBACV,wEAAwE;gBACxE,mEAAmE;gBACnE,mBAAmB,EAAE,IAAI;gBACzB,WAAW,EAAE,0CAA0C;gBACvD,oBAAoB,EAAE,IAAI;gBAC1B,oBAAoB,EAAE,SAAS;gBAC/B,2BAA2B,EAAE,EAAE;gBAC/B,iBAAiB,EAAE,EAAE;gBACrB,gBAAgB,EAAE,EAAE;gBACpB,eAAe,EAAE,SAAS;gBAC1B,eAAe,EAAE,SAAS;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,sBAAgE,EAChE,wBAAgD,EAChD,2BAA2F;IAE3F,KAAK,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC3F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,SAAS;QACX,CAAC;QAED,MAAM,mBAAmB,GAAG,YAA4B,CAAC;QACzD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,UAAU,CAAC,MAAM,CACpE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,wCAAwC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CACtH,CAAC;QACF,MAAM,qBAAqB,GAAG,wBAAwB,CAAC,MAAM,CAC3D,CAAC,YAAY,EAAE,EAAE,CACf,YAAY,CAAC,aAAa,KAAK,mBAAmB;eAC/C,YAAY,CAAC,aAAa,KAAK,mBAAmB,CACxD,CAAC;QAEF,qBAAqB,CAAC,UAAU,GAAG;YACjC,GAAG,sBAAsB;YACzB,GAAG,yCAAyC,CAC1C,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,CAC5B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,yCAAyC,CAAC,MAGlD;IACC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CACvC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAC5E,CAAC;IAEF,MAAM,gBAAgB,GAAU,EAAE,CAAC;IAEnC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAI,SAAmE,CAAC,gBAAgB,CAAC;QAC3G,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QAED,MAAM,yBAAyB,GAAG,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAExE,IAAI,CAAC,+BAA+B,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gBAAgB,yBAAyB,uFAAuF,CAC9J,CAAC;QACJ,CAAC;QAED,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,mBAAmB,GAAG,CAAC,SAAS,CAAC,qBAAqB,IAAI,SAAS,CAAC,mBAAmB,CAA0B,CAAC;QACxH,IAAI,mBAAmB,KAAK,qBAAqB,CAAC,IAAI,IAAI,mBAAmB,KAAK,qBAAqB,CAAC,MAAM,EAAE,CAAC;YAC/G,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gBAAgB,yBAAyB,wFAAwF,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAC7L,CAAC;QACJ,CAAC;QAED,sFAAsF;QACtF,6EAA6E;QAC7E,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gBAAgB,yBAAyB,sGAAsG,CAC7K,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnE,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gBAAgB,yBAAyB,wGAAwG,CAC/K,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,CAAC,mBAAmB,KAAK,SAAS,IAAI,YAAY,CAAC,mBAAmB,IAAI,CAAC,EAAE,CAAC;YAC5F,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gBAAgB,yBAAyB,wFAAwF,CAC/J,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,iDAAiD,CAAC,yBAAyB,CAAC,CAAC;QAC/H,IAAI,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvD,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,4CAA4C,mBAAmB,kDAAkD,CAC/I,CAAC;QACJ,CAAC;QACD,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAEnD,gBAAgB,CAAC,IAAI,CAAC;YACpB,GAAG,SAAS;YACZ,mBAAmB;YACnB,SAAS,EAAE,KAAK;YAChB,kBAAkB,EAAE,KAAK;YACzB,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,UAAU,CAAC,GAAG;YACxB,uFAAuF;YACvF,+FAA+F;YAC/F,qBAAqB,EAAE,mBAAmB;YAC1C,kBAAkB,EAAE;gBAClB,IAAI,EAAE,8BAA8B,CAAC,2BAA2B;gBAChE,yBAAyB;gBACzB,mBAAmB;gBACnB,MAAM,EAAE,YAAY;aACrB;YACD,gGAAgG;YAChG,+FAA+F;YAC/F,WAAW,EAAE,sCAAsC;YACnD,WAAW,EAAE,sCAAsC;YACnD,oBAAoB,EAAE,IAAI;YAC1B,0DAA0D;YAC1D,GAAG,EAAE,SAAS;YACd,gBAAgB,EAAE,SAAS;YAC3B,oBAAoB,EAAE,SAAS;YAC/B,2BAA2B,EAAE,EAAE;YAC/B,iBAAiB,EAAE,EAAE;YACrB,gBAAgB,EAAE,EAAE;YACpB,eAAe,EAAE,SAAS;YAC1B,eAAe,EAAE,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,uCAAuC,CAAC,MAOhD;IACC,MAAM,4BAA4B,GAAG,MAAM,CAAC,4BAA4B,IAAI,MAAM,CAAC,UAAU,CAAC;IAC9F,MAAM,eAAe,GAAG,gCAAgC,CAAC,4BAA4B,CAAC,CAAC;IACvF,MAAM,oBAAoB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,4FAA4F,oBAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3L,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAC5C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAChC,CAAC;IACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwDG;IACH,MAAM,0CAA0C,GAAqC;QACnF,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI;QAClC,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,IAAI;QACrC,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,KAAK;QACzC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,KAAK;KACrC,CAAC;IACF,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,eAAe,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAClD,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,eAAe,CAAC;eACnE,0BAA0B,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;QAC7F,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAChC,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,8FAA8F;kBACzH,8EAA8E;kBAC9E,uBAAuB,MAAM,CAAC,eAAe,CAAC,gBAAgB;kBAC9D,IAAI,kBAAkB,CAAC,OAAO,OAAO,kBAAkB,CAAC,UAAU,2DAA2D;kBAC7H,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/D,+BAA+B,CAAC,SAAS,CAAC,WAAW,CAAC;WACnD,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,MAAM;WAC9D,iBAAiB,IAAI,SAAS;WAC9B,SAAS,CAAC,eAAe,KAAK,IAAI;WAClC,SAAS,CAAC,kBAAkB,KAAK,IAAI,CACzC,CAAC;IACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,gGAAgG,CAC9H,CAAC;IACJ,CAAC;IAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CACvC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAC5E,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,4BAA4B;KACvC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;QAC3C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,+CAA+C,CAAC,SAAS,CAAC,CAAC;QAC7G,IAAI,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvD,MAAM,wBAAwB,CAC5B,IAAI,MAAM,CAAC,kBAAkB,0CAA0C,mBAAmB,kDAAkD,CAC7I,CAAC;QACJ,CAAC;QACD,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAEnD,OAAO;YACL,GAAG,mBAAmB;YACtB,mBAAmB;YACnB,SAAS,EAAE,KAAK;YAChB,kBAAkB,EAAE,KAAK;YACzB,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,UAAU,CAAC,IAAI;YACzB,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;YACnD,kBAAkB,EAAE;gBAClB,IAAI,EAAE,8BAA8B,CAAC,yBAAyB;gBAC9D,SAAS;aACV;YACD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,6EAA6E;YAC7E,4EAA4E;YAC5E,6CAA6C;YAC7C,mBAAmB,EAAE,IAAI;YACzB,WAAW;YACX,WAAW,EAAE,WAAW;YACxB,oBAAoB,EAAE,IAAI;YAC1B,oBAAoB,EAAE,SAAS;YAC/B,2BAA2B,EAAE,EAAE;YAC/B,iBAAiB,EAAE,EAAE;YACrB,gBAAgB,EAAE,EAAE;YACpB,eAAe,EAAE,SAAS;YAC1B,eAAe,EAAE,SAAS;SAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC,MAAM,6BAA6B,GAAuC,IAAI,GAAG,CAAC;IAChF,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,WAAW;CAClC,CAAC,CAAC;AACH,MAAM,8CAA8C,GAAuC,IAAI,GAAG,CAAC;IACjG,GAAG,6BAA6B;IAChC,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;CAC5B,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAClC,mBAA4B;IAE5B,OAAO,6BAA6B,CAAC,GAAG,CACtC,mBAA4C,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,mBAA4B;IAE5B,OAAO,8CAA8C,CAAC,GAAG,CACvD,mBAA4C,CAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,6BAA6B,CACpC,MAA6B,EAC7B,kBAA0B,EAC1B,mBAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,kBAAkB,IAAI,mBAAmB,mBAAmB,CAAC;IAEhF,iCAAiC;IACjC,IAAI,MAAM,CAAC,eAAe,KAAK,+BAA+B,CAAC,aAAa,EAAE,CAAC;QAC7E,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,wBAAwB,CAC5B,GAAG,MAAM,qDAAqD,MAAM,CAAC,OAAO,IAAI,SAAS,IAAI;gBAC7F,iDAAiD,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,MAAM,CAAC,eAAe,KAAK,+BAA+B,CAAC,aAAa,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACvG,MAAM,wBAAwB,CAC5B,GAAG,MAAM,qBAAqB,MAAM,CAAC,OAAO,4BAA4B,MAAM,CAAC,eAAe,IAAI;YAClG,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,wBAAwB,CAAC,GAAG,MAAM,0BAA0B,CAAC,CAAC;IACtE,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,wBAAwB,CAAC,GAAG,MAAM,6DAA6D,CAAC,CAAC;IACzG,CAAC;IAED,iFAAiF;IACjF,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,wBAAwB,CAAC,GAAG,MAAM,kCAAkC,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,oBAAoB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,wBAAwB,CAC5B,GAAG,MAAM,2DAA2D;YACpE,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACrD,MAAM,wBAAwB,CAC5B,GAAG,MAAM,wBAAwB,MAAM,CAAC,SAAS,2CAA2C;YAC5F,mDAAmD,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,6BAA6B,CACpC,MAA6B,EAC7B,kBAA0B,EAC1B,mBAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,kBAAkB,IAAI,mBAAmB,mBAAmB,CAAC;IAEhF,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,wBAAwB,CAAC,GAAG,MAAM,kEAAkE,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED,mCAAmC;AACnC,kCAAkC;AAClC,mCAAmC;AAEnC;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,KAAyC;IAC1E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,wDAAwD;QACxD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,CAAU,CAAC;AAC5H,+EAA+E;AAE/E,4GAA4G;AAE5G;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAa,EACb,gBAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAiC,EAAE,CAAC;QAErD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,WAA2B,CAAC;YAEhD,gCAAgC;YAChC,IAAK,qBAA2C,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAE/E,wEAAwE;YACxE,IAAK,+BAAqD,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAEzF,gDAAgD;YAChD,IAAI,cAAc,CAAC,WAAW,CAAC;gBAAE,SAAS;YAE1C,mCAAmC;YACnC,IAAI,oBAAoB,CAAC,WAAW,CAAC;gBAAE,SAAS;YAEhD,wEAAwE;YACxE,uDAAuD;YACvD,IAAI,sBAAsB,CAAC,WAAW,CAAC;gBAAE,SAAS;YAElD,mDAAmD;YACnD,oEAAoE;YACpE,oEAAoE;YAEpE,8EAA8E;YAC9E,wDAAwD;YACxD,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC;gBAAE,SAAS;YAExF,4BAA4B;YAC5B,IAAI,gBAAgB,EAAE,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAEpD,WAAW,CAAC,SAAS,CAAC,GAAG,qCAAqC,CAAC,WAA2B,CAAC,CAAC;QAC9F,CAAC;QAED,OAAO,qCAAqC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;QAC3C,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC;AAKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,qBAAqB,CAC5B,UAAa,EACb,gBAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAiC,EAAE,CAAC;QAErD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,WAA2B,CAAC;YAEhD,gCAAgC;YAChC,IAAK,qBAA2C,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAE/E,uEAAuE;YACvE,IAAK,+BAAqD,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAEzF,gDAAgD;YAChD,IAAI,cAAc,CAAC,WAAW,CAAC;gBAAE,SAAS;YAE1C,mCAAmC;YACnC,IAAI,oBAAoB,CAAC,WAAW,CAAC;gBAAE,SAAS;YAEhD,oEAAoE;YACpE,8DAA8D;YAC9D,IAAI,sBAAsB,CAAC,WAAW,CAAC;gBAAE,SAAS;YAElD,mDAAmD;YACnD,oEAAoE;YACpE,kEAAkE;YAElE,wDAAwD;YACxD,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS;gBAAE,SAAS;YAElD,4BAA4B;YAC5B,IAAI,gBAAgB,EAAE,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YAEpD,0EAA0E;YAC1E,uEAAuE;YACvE,2DAA2D;YAC3D,WAAW,CAAC,SAAS,CAAC,GAAG,oBAAoB,CAC3C,qCAAqC,CAAC,WAA2B,CAAC,CACnE,CAAC;QACJ,CAAC;QAED,OAAO,qCAAqC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;QAC3C,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,UAAa,EACb,WAA0B;IAE1B,8DAA8D;IAC9D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,qCAAqC,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IAED,sCAAsC;IACtC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,qBAAqB,CAAC,MAAM;YAC/B,OAAO,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAC3C,KAAK,qBAAqB,CAAC,MAAM;YAC/B,OAAO,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAC3C,KAAK,qBAAqB,CAAC,IAAI,CAAC;QAChC,KAAK,qBAAqB,CAAC,MAAM;YAC/B,8DAA8D;YAC9D,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB;YACE,kEAAkE;YAClE,0DAA0D;YAC1D,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,mCAAmC;AACnC,mCAAmC;AACnC,mCAAmC;AAEnC;;;;;;;;;;GAUG;AACH,SAAS,6BAA6B,CACpC,UAAwB,EACxB,kBAA0B;IAE1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAE5C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,WAA2B,CAAC;YAEhD,mDAAmD;YACnD,IAAI,cAAc,CAAC,WAAW,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CACT,UAAU,SAAS,0DAA0D;oBAC7E,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YAED,wDAAwD;YACxD,IAAI,oBAAoB,CAAC,WAAW,CAAC,IAAI,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3E,MAAM,CAAC,IAAI,CACT,UAAU,SAAS,+DAA+D;oBAClF,wFAAwF,CACzF,CAAC;YACJ,CAAC;YAED,oFAAoF;YACpF,uEAAuE;QACzE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;QAC/C,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,wBAAwB,CAC5B,aAAa,kBAAkB,yCAAyC;YACxE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/C,CAAC;IACJ,CAAC;AACH,CAAC;AAuBD,mCAAmC;AACnC,mBAAmB;AACnB,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,SAAS,8BAA8B,CACrC,qBAA6C,EAC7C,kBAAgC;IAKhC,4FAA4F;IAC5F,kGAAkG;IAClG,8FAA8F;IAC9F,uEAAuE;IACvE,EAAE;IACF,sFAAsF;IACtF,+FAA+F;IAC/F,EAAE;IACF,iGAAiG;IACjG,0FAA0F;IAC1F,gEAAgE;IAChE,0DAA0D;IAC1D,2CAA2C;IAC3C,EAAE;IACF,8EAA8E;IAC9E,sFAAsF;IACtF,oCAAoC;IACpC,sFAAsF;IAEtF,4DAA4D;IAC5D,uFAAuF;IACvF,qFAAqF;IACrF,+DAA+D;IAC/D,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEjF,MAAM,YAAY,GAAG,CAAC,GAAyB,EAAE,EAAE,CACjD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CAAC;IAExB,MAAM,8BAA8B,GAAgD;QAClF,kFAAkF;QAClF,oFAAoF;QACpF,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpD,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACnB;QACD,kBAAkB,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnD,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACnB;QACD,kEAAkE;QAClE,kFAAkF;QAClF,yEAAyE;QACzE,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClD,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACpF,CAAC,YAAY,CAAC,GAAG,CAAC,CACnB;KACF,CAAC;IAEF,2CAA2C;IAC3C,oDAAoD;IACpD,2CAA2C;IAE3C,MAAM,4BAA4B,GAAG,CACnC,uBAAwD,EAClC,EAAE,CACxB,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAEhF;;;;;;;;;;;OAWG;IACH,MAAM,0BAA0B,GAAG,CACjC,SAAuB,EACvB,UAAwB,EACxB,QAAsB,EACtB,UAAmB,EACG,EAAE,CACxB,4BAA4B,CAAC;QAC3B,YAAY,EAAE,+BAA+B,CAAC,GAAG,EAAG,cAAc;QAClE,YAAY,EAAE,+BAA+B,CAAC,IAAI,EAAE,iBAAiB;QACrE,aAAa,EAAE,SAAS,EAAK,oCAAoC;QACjE,aAAa,EAAE,UAAU,EAAI,6CAA6C;QAC1E,MAAM,EAAE,kBAAkB,CAAC,SAAS;QACpC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;QACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;QAC7E,cAAc,EAAE,KAAK;QACrB,UAAU;QACV,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,QAAQ;QAC1B,iBAAiB,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC;KAC9E,CAAC,CAAC;IAEL,4FAA4F;IAC5F,2EAA2E;IAC3E,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/D,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CACtB,CAAC;IAEF,6EAA6E;IAC7E,MAAM,uBAAuB,GAA2B,EAAE,CAAC;IAE3D,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACvC,qBAAqB,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;QAE9G,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAC7C,2CAA2C;YAC3C,yDAAyD;YACzD,2CAA2C;YAC3C,wEAAwE;YACxE,gDAAgD;YAChD,yCAAyC;YACzC,4EAA4E;YAC5E,EAAE;YACF,iFAAiF;YACjF,sFAAsF;YACtF,iFAAiF;YACjF,+EAA+E;YAC/E,qFAAqF;YACrF,yEAAyE;YAEzE,iFAAiF;YACjF,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG,EAAG,cAAc;gBAClE,YAAY,EAAE,+BAA+B,CAAC,IAAI,EAAE,qBAAqB;gBACzE,aAAa,EAAE,WAAW,EAAS,gCAAgC;gBACnE,aAAa,EAAE,kBAAkB,EAAE,8CAA8C;gBACjF,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,yEAAyE;gBACzE,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,uBAAuB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAElD,sFAAsF;YACtF,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG,EAAG,cAAc;gBAClE,YAAY,EAAE,+BAA+B,CAAC,IAAI,EAAE,qBAAqB;gBACzE,aAAa,EAAE,WAAW,EAAS,wBAAwB;gBAC3D,aAAa,EAAE,kBAAkB,EAAE,8CAA8C;gBACjF,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB,EAAE,0BAA0B;gBACzG,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,yEAAyE;gBACzE,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,0FAA0F;gBAC1F,eAAe,EAAE,eAAe;aACjC,CAAC,CAAC;YACH,uBAAuB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAEpD,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,2CAA2C;YAC3C,oEAAoE;YACpE,2CAA2C;YAC3C,iEAAiE;YACjE,gFAAgF;YAChF,iFAAiF;YACjF,+EAA+E;YAC/E,6EAA6E;YAE7E,IAAI,CAAC,iBAAiB;gBACpB,MAAM,wBAAwB,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YAEtI,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG,EAAG,aAAa;gBACjE,YAAY,EAAE,+BAA+B,CAAC,IAAI,EAAE,qBAAqB;gBACzE,aAAa,EAAE,kBAAkB,EAAI,iBAAiB;gBACtD,aAAa,EAAE,iBAAiB,EAAK,iBAAiB;gBACtD,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,uBAAuB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAE9C,0EAA0E;YAC1E,4EAA4E;YAC5E,uBAAuB,CAAC,IAAI,CAC1B,0BAA0B,CAAC,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,CAC3G,CAAC;QAEJ,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,2CAA2C;YAC3C,qEAAqE;YACrE,2CAA2C;YAC3C,sEAAsE;YACtE,4EAA4E;YAC5E,+EAA+E;YAE/E,IAAI,CAAC,iBAAiB;gBACpB,MAAM,wBAAwB,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YAEtI,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG,EAAG,aAAa;gBACjE,YAAY,EAAE,+BAA+B,CAAC,IAAI,EAAE,qBAAqB;gBACzE,aAAa,EAAE,kBAAkB,EAAI,iBAAiB;gBACtD,aAAa,EAAE,iBAAiB,EAAK,iBAAiB;gBACtD,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,eAAe;gBAChC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,uBAAuB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAE9C,0EAA0E;YAC1E,4EAA4E;YAC5E,uBAAuB,CAAC,IAAI,CAC1B,0BAA0B,CAAC,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACpC,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,EAAE,CAAC;YACzF,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;aAAM,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,EAAE,CAAC;YAChG,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9D,CAAC;aAAM,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,EAAE,CAAC;YAChG,8BAA8B,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,qFAAqF;IACrF,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;QAC3C,GAAG,8BAA8B,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;QACnF,GAAG,8BAA8B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;KAClF,CAAC,CAAC;IAEH,OAAO;QACL,8BAA8B;QAC9B,4BAA4B;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,iDAAiD,CACxD,qBAAkE,EAClE,4BAA+C,EAC/C,0CAA0I,EAC1I,mBAA2B;IAE3B,IAAI,CAAC,0CAA0C,IAAI,0CAA0C,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3G,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,qEAAqE;IACrE,KAAK,MAAM,QAAQ,IAAI,0CAA0C,EAAE,CAAC;QAClE,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7D,MAAM,wBAAwB,CAAC,cAAc,mBAAmB,6DAA6D,QAAQ,CAAC,YAAY,kDAAkD,CAAC,CAAC;QACxM,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAyD,CAAC;IACrF,0CAA0C,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QAC5D,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,CAAC,GAAyB,EAAwB,EAAE;QACxE,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC5D,OAAO,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAClG,CAAC,CAAC;IAEF,MAAM,4BAA4B,GAAgD;QAChF,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC;QACjF,kBAAkB,EAAE,CAAC,GAAG,qBAAqB,CAAC,kBAAkB,CAAC;QACjE,2EAA2E;QAC3E,iBAAiB,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC;KAC9E,CAAC;IAEF,OAAO,4BAA4B,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,iBAA+E,EAC/E,kBAAgC,EAChC,mBAA2B,EAC3B,oBAA0C;IAG1C,2CAA2C;IAC3C,0CAA0C;IAC1C,2CAA2C;IAE3C,2DAA2D;IAC3D,MAAM,4BAA4B,GAAG,IAAI,GAAG,EAAwE,CAAC;IACrH,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,4BAA4B,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,KAAK,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,IAAI,4BAA4B,CAAC,OAAO,EAAE,EAAE,CAAC;QACpF,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC9B,4CAA4C;YAC5C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;YACxE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,wBAAwB,CAC5B,cAAc,kBAAkB,IAAI,mBAAmB,SAAS,aAAa,CAAC,MAAM,uCAAuC,aAAa,KAAK;oBAC7I,6HAA6H;oBAC7H,GAAG,WAAW,CAAC,MAAM,qDAAqD,CAC3E,CAAC;YACJ,CAAC;YAED,mDAAmD;YACnD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;YAC7D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpC,MAAM,wBAAwB,CAC5B,cAAc,kBAAkB,IAAI,mBAAmB,oEAAoE,aAAa,KAAK;oBAC7I,mFAAmF;oBACnF,gBAAgB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,uBAAuB;IACvB,2CAA2C;IAE3C,OAAO,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE;QAC1C,2IAA2I;QAC3I,MAAM,eAAe,GAAG;YACtB,kBAAkB;YAClB,mBAAmB;YACnB,YAAY,CAAC,MAAM;SACpB,CAAC;QAEF,4DAA4D;QAC5D,IAAI,YAAY,CAAC,qBAAqB,EAAE,CAAC;YACvC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QAED,2BAA2B;QAC3B,IAAI,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,uBAAuB;QACvB,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;YACvB,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,uBAAuB,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE1D,OAAO;YACL,GAAG,YAAY;YACf,UAAU,EAAE,uBAAuB;YACnC,YAAY,EAAE,oBAAoB;SACnC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,gBAA8D,EAC9D,kBAAgC,EAChC,mBAA2B;IAE3B,OAAO,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE;QACzC,kFAAkF;QAClF,MAAM,uBAAuB,GAAG;YAC9B,kBAAkB;YAClB,mBAAmB;YACnB,YAAY,CAAC,OAAO;SACrB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,OAAO;YACL,GAAG,YAAY;YACf,UAAU,EAAE,uBAAuB;SACpC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAGnC,SAAS,qCAAqC,CAAyB,MAItE;IAEC,MAAM,EACJ,UAAU,EACV,wBAAwB,GAAG,IAAI,EAC/B,sBAAsB,GAAG,EAAE,EAC5B,GAAG,MAAM,CAAC;IAEX,qCAAqC;IACrC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,wBAAwB,CAAC,yDAAyD,CAAC,CAAC;IAC5F,CAAC;IAED,mEAAmE;IACnE,IAAI,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;QACtC,OAAO,UAAU,CAAC,SAAS,KAAK,UAAU;QAC1C,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,wBAAwB,CAAC,qDAAqD,OAAO,UAAU,kBAAkB,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1J,CAAC;IAED,IAAI,wBAAwB,EAAE,CAAC;QAC7B,IAAI,OAAO,sBAAsB,KAAK,QAAQ,IAAI,sBAAsB,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,wBAAwB,CAAC,0DAA0D,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,MAAM,qBAAqB,GAAG,CAAC,MAAS,EAAE,EAAE;QAC1C,IAAI,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAElC,IAAI,wBAAwB,EAAE,CAAC;YAC7B,IAAI,sBAAsB,GAAG,CAAC,EAAE,CAAC;gBAC/B,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,sBAAsB,EAAE,uCAAuC,sBAAsB,QAAQ,CAAC,CAAC;YAC/H,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,uDAAuD;IACvD,MAAM,yBAAyB,GAAG,CAAC,KAAU,EAAqD,EAAE;QAClG,0BAA0B;QAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,qBAAqB,CAAC,sCAAsC,CAAC,CAAC;QACtE,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QAC7E,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,qBAAqB,CAAC,6BAA6B,CAAC,CAAC;QAC7D,CAAC;QAED,wCAAwC;QACxC,IAAI,wBAAwB,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;gBAC/C,MAAM,qBAAqB,CAAC,uCAAuC,sBAAsB,eAAe,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/H,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,qBAAqB,CAAC,mDAAmD,CAAC,CAAC;QACnF,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC9D,MAAM,qBAAqB,CAAC,oCAAoC,CAAC,CAAC;QACpE,CAAC;QAED,sCAAsC;QACtC,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAC1E,KAAK,MAAM,KAAK,IAAI,wBAAwB,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,qBAAqB,CAAC,2BAA2B,KAAK,SAAS,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAChD,MAAM,qBAAqB,CAAC,eAAe,KAAK,oBAAoB,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,qBAAqB,CAAC,eAAe,KAAK,wBAAwB,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YAC3F,MAAM,qBAAqB,CAAC,wCAAwC,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,qBAAqB,CAAC,mCAAmC,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,yDAAyD;IACzD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;QAC5B,IAAI,EAAE,qBAAqB,CAAC,UAAU,CAAC;QACvC,8FAA8F;QAC9F,uFAAuF;QACvF,UAAU,EAAE,sCAAsC,CAAC,sBAAsB,CAAC;KAC3E,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE;QACnC,OAAO,EAAE,sCAAsC;KAChD,CAAC,CAAC;IAEH,OAAO,YAAmE,CAAC;AAC7E,CAAC;AAID,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sCAAsC,CAGpD,MAgBD;IAEC,MAAM,EAAE,YAAY,EAAE,iBAAiB,GAAG,EAAE,EAAE,UAAU,GAAG,IAAI,EAAE,8BAA8B,EAAE,GAAG,MAAM,CAAC;IAE3G,4BAA4B;IAC5B,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,wBAAwB,CAAC,iCAAiC,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3D,MAAM,wBAAwB,CAAC,sCAAsC,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1I,MAAM,wBAAwB,CAAC,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IAED,wCAAwC;IACxC,MAAM,kBAAkB,GAAG,CAA6C,MAAS,EAAE,EAAE;QACnF,MAAM,eAAe,GAAuC,EAAE,CAAC;QAE/D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE;YAC/C,mDAAmD;YACnD,IAAI,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;gBAChC,eAAe,CAAC,GAAG,CAAC,GAAG,gCAAgC,CAAC,QAAQ,EAAE,CAAC;YACrE,CAAC;iBAAM,IAAI,MAAM,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;gBACzC,eAAe,CAAC,GAAG,CAAC,GAAI,MAAsB,CAAC,QAAQ,EAAE,CAAC;YAC5D,CAAC;iBAAM,IAAI,MAAM,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;gBACzC,eAAe,CAAC,GAAG,CAAC,GAAI,MAAsB,CAAC,QAAQ,EAAE,CAAC;YAC5D,CAAC;iBAAM,IAAI,MAAM,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC1C,eAAe,CAAC,GAAG,CAAC,GAAI,MAAuB,CAAC,QAAQ,EAAE,CAAC;YAC7D,CAAC;iBAAM,IAAI,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;gBACvC,eAAe,CAAC,GAAG,CAAC,GAAI,MAAyB,CAAC,QAAQ,EAAE,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,qCAAqC;gBACrC,eAAe,CAAC,GAAG,CAAC,GAAI,MAAuB,CAAC,QAAQ,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,2BAA2B,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7D,CAAC,CAAC;IAEF,yCAAyC;IACzC,MAAM,mBAAmB,GAAG,CAAC,MAAyB,EAAE,EAAE;QACxD,MAAM,aAAa,GAAoD,EAAE,CAAC;QAE1E,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YACrB,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC9B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;gBACvB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC;gBAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC,CAAC;IAGF,mDAAmD;IACnD,MAAM,YAAY,GAAQ,EAAE,CAAC;IAE7B,6BAA6B;IAC7B,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,2FAA2F;IAC3F,6FAA6F;IAC7F,IAAI,UAAU,EAAE,CAAC;QACf,YAAY,CAAC,UAAU,GAAG,6BAA6B,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrG,CAAC;IAED,6CAA6C;IAC7C,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,YAAY,CAAC,OAAO,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAChE,CAAC;IAED,uCAAuC;IACvC,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,YAAY,CAAC,OAAO,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,OAAO,GAAG,2BAA2B,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,0CAA0C;IAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAE5C,OAAO,YAA4E,CAAC;AACtF,CAAC;AAMD,4DAA4D;AAC5D,SAAS,8BAA8B,CAAC,SAAiB;IACvD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,qBAAqB,CAAC,IAAI,CAAC;QAChC,KAAK,qBAAqB,CAAC,IAAI,CAAC;QAChC,KAAK,qBAAqB,CAAC,MAAM,CAAC;QAClC,KAAK,qBAAqB,CAAC,KAAK;YAC9B,OAAO,UAAU,CAAC,GAAG,CAAC;QACxB,KAAK,qBAAqB,CAAC,MAAM,CAAC;QAClC,KAAK,qBAAqB,CAAC,WAAW;YACpC,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,KAAK,qBAAqB,CAAC,MAAM,CAAC;QAClC,KAAK,qBAAqB,CAAC,WAAW;YACpC,OAAO,UAAU,CAAC,GAAG,CAAC;QACxB,KAAK,qBAAqB,CAAC,MAAM,CAAC;QAClC,KAAK,qBAAqB,CAAC,WAAW;YACpC,OAAO,UAAU,CAAC,MAAM,CAAC;QAC3B;YACE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,iCAAiC;IAC7D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,gCAAgC,CACvC,kBAAmF,EACnF,cAA6E;IAE7E,+EAA+E;IAC/E,mFAAmF;IACnF,qFAAqF;IACrF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,cAAc,CAAC,SAAS,KAAK,KAAK,CAAC;IAC5C,CAAC;IAED,sEAAsE;IACtE,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC/D,OAAO,CAAC,SAAS,KAAK,IAAI,CAC3B,CAAC;IAEF,kEAAkE;IAClE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,cAAc,KAAK,sBAAsB,CAAC;IACnD,CAAC;IAED,gGAAgG;IAChG,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC7D,OAAO,CAAC,SAAS,KAAK,KAAK,CAC5B,CAAC;IAEF,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,cAAc,KAAK,oBAAoB,CAAC;IACjD,CAAC;IAED,mFAAmF;IACnF,OAAO,cAAc,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,WAAW;IACX,cAAc;CACf,CAAC,CAAC;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,qBAAqB,CAAC,OAAO;IAC7B,qBAAqB,CAAC,OAAO;CAC9B,CAAC,CAAC;AAEH,SAAS,uCAAuC,CAC9C,SAAiB,EACjB,OAAsE;IAEtE,MAAM,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,IAAI,SAAS,CAAC;IACtE,OAAO,kBAAkB,KAAK,qBAAqB,CAAC,IAAI;WACnD,kBAAkB,KAAK,qBAAqB,CAAC,IAAI;WACjD,kBAAkB,KAAK,qBAAqB,CAAC,MAAM,CAAC;AAC3D,CAAC;AAED,mCAAmC;AACnC,iCAAiC;AACjC,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,UAAU,0CAA0C,CAIxD,MAED;IAEC,MAAM,EACJ,UAAU,EACV,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,GAAG,KAAK;IACxB,gGAAgG;IAChG,+FAA+F;IAC/F,6BAA6B,GAAG,IAAI;IACpC,4EAA4E;IAC5E,yEAAyE;IACzE,sDAAsD;IACtD,iDAAiD;IACjD,4EAA4E;IAC5E,cAAc;IACd,kBAAkB,GAAG;QACnB,IAAI,EAAE,wBAAwB,CAAC,SAAS;QACxC,IAAI,EAAE,wBAAwB,CAAC,SAAS;QACxC,MAAM,EAAE,wBAAwB,CAAC,SAAS;QAC1C,MAAM,EAAE,wBAAwB,CAAC,SAAS;QAC1C,UAAU,EAAE,wBAAwB,CAAC,SAAS;KAC/C,EACD,cAAc,GAAG,KAAK,EACtB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,uBAAuB,GACxB,GAAG,MAAM,CAAC;IAEX;;;;;;;;;;;OAWG;IACH,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACvF,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,kJAAkJ,CACzK,CAAC;IACJ,CAAC;IACD,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,aAAa,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAClG,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,kJAAkJ,CACzK,CAAC;IACJ,CAAC;IACD,IAAI,oBAAoB,KAAK,SAAS,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAClG,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,mEAAmE,MAAM,CAAC,kBAAkB,IAAI,kCAAkC,CAAC,4HAA4H,CACtR,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;QACvF,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,6DAA6D,MAAM,CAAC,kBAAkB,IAAI,kCAAkC,CAAC,gIAAgI,CACpR,CAAC;IACJ,CAAC;IACD;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,IAAI,2BAA2B,KAAK,SAAS,EAAE,CAAC;QACpG,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,oQAAoQ,CAC3R,CAAC;IACJ,CAAC;IACD,wFAAwF;IACxF,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,4FAA4F;IAC5F,MAAM,sBAAsB,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;QAC9E,MAAM,YAAY,GAAG,4BAA4B,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC5E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,yCAAyC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9K,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,oCAAoC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxH,CAAC;QACJ,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC;IAC3B,CAAC,CAAC,EAAE,CAAC;IAEL;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;QACzF,MAAM,MAAM,GAAG,CAAC,OAAe,EAAS,EAAE;YACxC,MAAM,wBAAwB,CAAC,IAAI,kBAAkB,+CAA+C,OAAO,EAAE,CAAC,CAAC;QACjH,CAAC,CAAC;QACF,IAAI,kBAAkB,KAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,CAAC,gKAAgK,CAAC,CAAC;QAC3K,CAAC;QACD,MAAM,gBAAgB,GAAG,qCAAqC,CAAC,SAAS,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACtG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAK,CAAC;QAC3C,IAAI,CAAC;YACH,8CAA8C,CAAC,WAAW,CAAC,CAAC;YAC5D,oCAAoC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAE,OAAe,EAAgB,EAAE;YAC/E,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,WAAW;gBAAE,MAAM,CAAC,GAAG,OAAO,kBAAkB,SAAS,iCAAiC,CAAC,CAAC;YACjG,IAAI,CAAC,oBAAoB,CAAC,WAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,WAAY,CAAC,EAAE,CAAC;gBAC/E,MAAM,CACJ,GAAG,OAAO,kBAAkB,SAAS,0MAA0M,CAChP,CAAC;YACJ,CAAC;YACD,OAAO,WAAY,CAAC;QACtB,CAAC,CAAC;QAEF,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;QACnG,IAAI,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,yBAAyB,WAAW,CAAC,mBAAmB,iEAAiE,CAAC,CAAC;QACpI,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC;YACxC,MAAM,CACJ,yBAAyB,WAAW,CAAC,mBAAmB,gKAAgK,CACzN,CAAC;QACJ,CAAC;QACD,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,+FAA+F;QAC/F,6FAA6F;QAC7F,YAAY;QACZ,EAAE;QACF,uFAAuF;QACvF,2FAA2F;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,uFAAuF;QACvF,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,MAAM,CACJ,yBAAyB,WAAW,CAAC,mBAAmB,4TAA4T,CACrX,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;YAC7F,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,YAAY,EAAE,CAAC;gBAC7D,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,YAAY,CAAC,YAAY,CAAC,KAAK,YAAY,EAAE,CAAC;oBACnE,MAAM,CACJ,YAAY,KAAK,CAAC,UAAU,qNAAqN,CAClP,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,CAAC,QAAQ,KAAK,yBAAyB,CAAC,kBAAkB,IAAI,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1H,MAAM,CAAC,YAAY,KAAK,CAAC,UAAU,uDAAuD,CAAC,CAAC;gBAC9F,CAAC;gBACD,wFAAwF;gBACxF,0FAA0F;gBAC1F,yFAAyF;gBACzF,0FAA0F;gBAC1F,wFAAwF;gBACxF,2DAA2D;gBAC3D,IACE,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY;uBACjE,KAAK,CAAC,QAAQ,KAAK,yBAAyB,CAAC,IAAI;uBACjD,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,EACxD,CAAC;oBACD,KAAK,CAAC,QAAQ,GAAG,yBAAyB,CAAC,kBAAkB,CAAC;gBAChE,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,UAAU,KAAK,iCAAiC,CAAC,MAAM,EAAE,CAAC;YACxE,8FAA8F;YAC9F,6EAA6E;YAC7E,yFAAyF;YACzF,8FAA8F;YAC9F,4FAA4F;YAC5F,6CAA6C;YAC7C,MAAM,YAAY,GAAyB,IAAI,GAAG,CAAU;gBAC1D,qBAAqB,CAAC,MAAM;gBAC5B,qBAAqB,CAAC,WAAW;aAClC,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;YAC1C,KAAK,MAAM,SAAS,IAAK,cAA4B,EAAE,CAAC;gBACtD,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAC1E,CAAC;YACD,KAAK,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,uBAAuB,IAAI,EAAE,CAA4B,CAAC,EAAE,CAAC;gBACzH,MAAM,QAAQ,GAAI,eAA6E,EAAE,QAAQ,IAAI,EAAE,CAAC;gBAChH,MAAM,mBAAmB,GAAc,QAAQ,CAAC,MAAM,GAAG,CAAC;oBACxD,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,IAAI,YAAY,CAAC;oBAC1E,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBACnB,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;oBACzE,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CACJ,sFAAsF,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,kLAAkL,CAC/S,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,+BAA+B,GAAG,qBAAqB,CAAC,2BAA2B,CACvF,qBAAqB,CACtB,CAAC;IAEF,2CAA2C;IAC3C,kCAAkC;IAClC,2CAA2C;IAE3C,uEAAuE;IACvE,6BAA6B,CAAC,UAAU,EAAE,kBAA4B,CAAC,CAAC;IAExE,2CAA2C;IAC3C,gCAAgC;IAChC,2CAA2C;IAC3C,EAAE;IACF,oEAAoE;IACpE,6EAA6E;IAC7E,EAAE;IACF,2EAA2E;IAC3E,mGAAmG;IACnG,iCAAiC;IACjC,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,8DAA8D;IAC9D,8EAA8E;IAC9E,EAAE;IACF,mEAAmE;IACnE,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,0EAA0E;IAC1E,wDAAwD;IACxD,EAAE;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,sCAAsC;IACtC,EAAE;IACF,0EAA0E;IAC1E,0DAA0D;IAC1D,6DAA6D;IAC7D,2EAA2E;IAC3E,qEAAqE;IACrE,8EAA8E;IAE9E,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAC7E,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,kBAAkB,CAClD,CAAC;IAEF,MAAM,qBAAqB,GAAG,+BAA+B,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACzE,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,CACrF,CAAC;IACF,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC;IAEhG,IAAI,oBAA0C,CAAC;IAC/C,IAAI,cAAc,EAAE,CAAC;QACnB,oBAAoB,GAAG,cAAc,CAAC,CAAC,CAAyB,CAAC;IACnE,CAAC;SAAM,IAAI,wBAAwB,EAAE,YAAY,EAAE,CAAC;QAClD,oBAAoB,GAAG,wBAAwB,CAAC,YAAY,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,yCAAyC;YAC/D,IAAI;YACJ,uEAAuE;YACvE,qEAAqE;YACrE,+DAA+D;YAC/D,wEAAwE;YACxE,2EAA2E;YAC3E,mDAAmD;YACnD,iEAAiE;YACjE,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,4CAA4C;YAC5C,IAAI;YACJ,qCAAqC,kBAAkB,MAAM;YAC7D,IAAI;YACJ,2EAA2E;YAC3E,uEAAuE;YACvE,IAAI;YACJ,kCAAkC;YAClC,wCAAwC,kBAA4B,MAAM;YAC1E,kFAAkF;YAClF,SAAS;YACT,kFAAkF;YAClF,+BAA+B;YAC/B,+CAA+C;YAC/C,4CAA4C;YAC5C,SAAS;YACT,OAAO;YACP,IAAI;YACJ,uEAAuE;YACvE,iEAAiE;YACjE,IAAI;YACJ,4EAA4E;YAC5E,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,iDAAiD;IACjD,2CAA2C;IAE3C,IAAI,mBAAmB,GAAgB,UAAU,CAAC;IAClD,IAAI,8BAA8B,GAAG,+BAA+B,CAAC;IACrE,IAAI,2BAA2B,GAAG,kBAAkB,CAAC;IAErD,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,oBAAoB,KAAK,oBAAoB,CAAC,SAAS,EAAE,CAAC;YAC5D,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,+DAA+D,oBAAoB,GAAG,CAC7G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,iEAAiE,CACxF,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAI,WAA4B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gEAAgE;oBACtF,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAAS,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa;gBAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,0FAA0F,CACjH,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,mGAAmG;QACnG,6FAA6F;QAC7F,6EAA6E;QAC7E,KAAK,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,mDAAmD,EAAE,CAAC;YAC/G,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAkB,CAAC,CAAC,EAAE,CAAC;gBACpF,SAAS;YACX,CAAC;YACD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,mCAAmC,6BAA6B,CAAC,YAAY,CAAC,GAAG;gBACvG,sBAAsB,SAAS,KAAK,GAAG,IAAI,CAC5C,CAAC;QACJ,CAAC;QAED,mBAAmB,GAAI,UAAkB,CAAC,MAAM,CAAC;YAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;SAChE,CAAgB,CAAC;QAElB,MAAM,qBAAqB,GAAG,2BAA2B,CACvD,gBAAgB,CAAC,eAA+B,EAChD,kBAAkB,EAClB,+BAA+B,CAAC,GAAG,EACnC,wBAAyB,CAAC,YAAY,EACtC;YACE,mBAAmB,EAAE,uCAAuC,CAAC,UAAU;YACvE,eAAe,EAAE,iBAAiB;YAClC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;YACrE,MAAM,EAAE,wBAAyB,CAAC,iBAAiB,CAAC,MAAM;YAC1D,IAAI,EAAE,wBAAyB,CAAC,IAAI;YACpC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACjC,eAAe,EAAE,wBAAyB,CAAC,eAAe,EAAE,SAAS;gBACnE,CAAC,CAAC,EAAE,SAAS,EAAE,wBAAyB,CAAC,eAAe,CAAC,SAAS,EAAE;gBACpE,CAAC,CAAC,SAAS;SACd,CACF,CAAC;QACF,8BAA8B,GAAG,CAAC,GAAG,+BAA+B,EAAE,qBAAqB,CAAC,CAAC;QAE7F,yEAAyE;QACzE,EAAE;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,qEAAqE;QACrE,4EAA4E;QAC5E,0EAA0E;QAC1E,4BAA4B;QAC5B,EAAE;QACF,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,iEAAiE;QACjE,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,YAAY;QACZ,EAAE;QACF,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,0BAA0B;QAC1B,EAAE;QACF,qEAAqE;QACrE,2EAA2E;QAC3E,2EAA2E;QAC3E,mEAAmE;QACnE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,MAAM,CAAC,kBAAkB,EAAE,UAAU,KAAK,wBAAwB,CAAC,SAAS,EAAE,CAAC;YACjF,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,0EAA0E;gBAChG,kGAAkG;gBAClG,oGAAoG;gBACpG,wGAAwG;gBACxG,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,2BAA2B,GAAG;YAC5B,GAAG,kBAAkB;YACrB,UAAU,EAAE,wBAAwB,CAAC,OAAO;SAC7C,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,yEAAyE;IACzE,2CAA2C;IAC3C,EAAE;IACF,+EAA+E;IAC/E,0EAA0E;IAC1E,2EAA2E;IAC3E,gFAAgF;IAChF,6EAA6E;IAC7E,qFAAqF;IACrF,oDAAoD;IACpD,IAAI,eAAe,EAAE,IAAI,EAAE,CAAC;QAC1B,+FAA+F;QAC/F,2FAA2F;QAC3F,oFAAoF;QACpF,kGAAkG;QAClG,2FAA2F;QAC3F,KAAK,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,gDAAgD,EAAE,CAAC;YACrG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,iBAAwB,CAAC,EAAE,CAAC;gBACvD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,8BAA8B,iBAAiB,uBAAuB,GAAG,IAAI,CACpG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2FAA2F;QAC3F,4FAA4F;QAC5F,6FAA6F;QAC7F,6FAA6F;QAC7F,sEAAsE;QACtE,8FAA8F;QAC9F,yFAAyF;QACzF,iEAAiE;QACjE,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACtC,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uEAAuE;gBAC7F,yGAAyG,CAC1G,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QAC7D,KAAK,MAAM,aAAa,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,CAAU,EAAE,CAAC;YAC7E,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjC,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,yCAAyC,aAAa,oBAAoB;oBAChG,4GAA4G,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,2FAA2F;QAC3F,2CAA2C;QAC3C,EAAE;QACF,+FAA+F;QAC/F,6FAA6F;QAC7F,iGAAiG;QACjG,gGAAgG;QAChG,oEAAoE;QACpE,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,wFAAwF;QACxF,0EAA0E;QAC1E,8FAA8F;QAC9F,6FAA6F;QAC7F,yFAAyF;QACzF,8FAA8F;QAC9F,wFAAwF;QACxF,qFAAqF;QACrF,gGAAgG;QAChG,iGAAiG;QACjG,0FAA0F;QAC1F,8FAA8F;QAC9F,8FAA8F;QAC9F,gBAAgB;QAChB,+FAA+F;QAC/F,4FAA4F;QAC5F,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACrE,MAAM,SAAS,GAAG,yBAAyB,CAAC,WAA2B,CAAC,CAAC;YACzE,IAAI,SAAS,KAAK,SAAS;gBAAE,SAAS;YAEtC,4FAA4F;YAC5F,6FAA6F;YAC7F,IAAI,mCAAmC,CAAC,SAAS,CAAC;gBAAE,SAAS;YAE7D,iGAAiG;YACjG,iGAAiG;YACjG,gGAAgG;YAChG,4FAA4F;YAC5F,yDAAyD;YACzD,MAAM,YAAY,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAC;YAClE,IACE,SAAS,KAAK,aAAa,CAAC,MAAM;gBAClC,YAAY,KAAK,SAAS;gBAC1B,YAAY,KAAK,oBAAoB,EACrC,CAAC;gBACD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,YAAY,SAAS,4DAA4D;oBACvG,8BAA8B,YAAY,+DAA+D;oBACzG,wGAAwG;oBACxG,qFAAqF,CACtF,CAAC;YACJ,CAAC;YAED,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,+FAA+F;YAC/F,8FAA8F;YAC9F,8FAA8F;YAC9F,0FAA0F;YAC1F,gGAAgG;YAChG,0EAA0E;YAE1E,0FAA0F;YAC1F,6FAA6F;YAC7F,0FAA0F;YAC1F,4FAA4F;YAC5F,2FAA2F;YAC3F,uFAAuF;YACvF,IAAI,SAAS,KAAK,aAAa,CAAC,IAAI,IAAI,yBAAyB,CAAC,WAA2B,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC7G,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,YAAY,SAAS,6DAA6D;oBACxG,IAAI,SAAS,iGAAiG,CAC/G,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;gBACvC,yFAAyF;gBACzF,0FAA0F;gBAC1F,kFAAkF;gBAClF,mBAAmB;gBACnB,EAAE;gBACF,mFAAmF;gBACnF,2FAA2F;gBAC3F,wFAAwF;gBACxF,4FAA4F;gBAC5F,sFAAsF;gBACtF,UAAU;gBACV,IAAI,CAAC,0BAA0B,CAAC,WAA2B,CAAC,EAAE,CAAC;oBAC7D,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,YAAY,SAAS,8DAA8D;wBACzG,uGAAuG;wBACvG,oGAAoG;wBACpG,yEAAyE,CAC1E,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;gBAC5C,4FAA4F;gBAC5F,6FAA6F;gBAC7F,0FAA0F;gBAC1F,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,WAA2B,CAAC,CAAC;gBACtF,IAAI,CAAE,WAA4B,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE,CAAC;oBACzE,MAAM,wBAAwB,CAC5B,kBAAkB,KAAK,2BAA2B;wBAChD,CAAC,CAAC,IAAI,kBAAkB,YAAY,SAAS,0DAA0D;4BACrG,sCAAsC,2BAA2B,uCAAuC;4BACxG,uGAAuG;4BACvG,2EAA2E;4BAC3E,gGAAgG;wBAClG,CAAC,CAAC,IAAI,kBAAkB,YAAY,SAAS,+CAA+C;4BAC1F,cAAc,kBAAkB,gEAAgE;4BAChG,8FAA8F;4BAC9F,6CAA6C,CAClD,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,KAAK,aAAa,CAAC,KAAK,EAAE,CAAC;gBAC7C;;;;;;;;;;;;;mBAaG;gBACH,IAAI,CAAC;oBACH,8BAA8B,CAAC,WAA2B,EAAE,SAAS,CAAC,CAAC;gBACzE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kGAAkG;QAClG,gGAAgG;QAChG,kGAAkG;QAClG,gGAAgG;QAChG,sGAAsG;QACtG,gGAAgG;QAChG,oGAAoG;QACpG,iFAAiF;QACjF,0FAA0F;QAC1F,oGAAoG;QACpG,+FAA+F;QAC/F,qGAAqG;QACrG,sGAAsG;QACtG,oCAAoC,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;QAE9E,+FAA+F;QAC/F,+FAA+F;QAC/F,mDAAmD;QACnD,MAAM,mBAAmB,GAAG,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;QAC9E,IAAI,eAAe,CAAC,IAAI,KAAK,oBAAoB,CAAC,WAAW,EAAE,CAAC;YAC9D,iGAAiG;YACjG,gGAAgG;YAChG,4EAA4E;YAC5E,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uFAAuF;oBAC7G,0BAA0B,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;oBAC7G,+GAA+G,CAChH,CAAC;YACJ,CAAC;YACD;;;;;;;;;;;;;eAaG;YACH,MAAM,0BAA0B,GAAG,iCAAiC,CAAC,mBAAmB,CAAC,CAAC;YAC1F,IAAI,0BAA0B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uFAAuF;oBAC7G,0BAA0B,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C;oBAC3G,6GAA6G;oBAC7G,qGAAqG;oBACrG,2GAA2G,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,mFAAmF;gBACzG,2GAA2G;gBAC3G,iGAAiG;gBACjG,0GAA0G;gBAC1G,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,gFAAgF;QAChF,iFAAiF;QACjF,+EAA+E;QAC/E,gFAAgF;QAChF,mBAAmB,GAAI,mBAA2B,CAAC,MAAM,CAAC;YACxD,eAAe,EAAE,qBAAqB;iBACnC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;iBAC/B,WAAW,EAAE;iBACb,iBAAiB,EAAE;iBACnB,iBAAiB,EAAE;iBACnB,QAAQ,EAAE;YACb,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE;iBACvB,QAAQ,EAAE;iBACV,WAAW,EAAE;iBACb,iBAAiB,EAAE;iBACnB,iBAAiB,EAAE;iBACnB,QAAQ,EAAE;SACd,CAAgB,CAAC;QAElB,qEAAqE;QACrE,gFAAgF;QAChF,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,kFAAkF;QAClF,0EAA0E;QAC1E,iFAAiF;QACjF,IAAI,MAAM,CAAC,kBAAkB,EAAE,UAAU,KAAK,wBAAwB,CAAC,SAAS,EAAE,CAAC;YACjF,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,qEAAqE;gBAC3F,kGAAkG;gBAClG,yGAAyG,CAC1G,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,kBAAkB,EAAE,WAAW,KAAK,wBAAwB,CAAC,SAAS,EAAE,CAAC;YAClF,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,sEAAsE;gBAC5F,yFAAyF;gBACzF,iGAAiG,CAClG,CAAC;QACJ,CAAC;QACD,2BAA2B,GAAG;YAC5B,GAAG,2BAA2B;YAC9B,UAAU,EAAE,wBAAwB,CAAC,OAAO;YAC5C,WAAW,EAAE,wBAAwB,CAAC,OAAO;SAC9C,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,iGAAiG;IACjG,qDAAqD;IACrD,EAAE;IACF,6FAA6F;IAC7F,mGAAmG;IACnG,kGAAkG;IAClG,oBAAoB;IACpB,EAAE;IACF,kFAAkF;IAClF,yFAAyF;IACzF,6FAA6F;IAC7F,iGAAiG;IACjG,qGAAqG;IACrG,IAAI,eAAe,EAAE,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uEAAuE;YAC7F,6FAA6F;YAC7F,+FAA+F;YAC/F,0FAA0F;YAC1F,8FAA8F;YAC9F,2FAA2F;YAC3F,6FAA6F;YAC7F,8FAA8F;YAC9F,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;QAChD,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,0EAA0E;YAChG,sFAAsF;YACtF,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,IAAI,KAAK,uBAAuB,CAAC,gBAAgB,CAAC;QAChG,IAAI,mBAAmB,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,CAAC;YACpE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uDAAuD;gBAC7E,8FAA8F;gBAC9F,iGAAiG,CAClG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,mBAAmB,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,CAAC;YACpE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gEAAgE;gBACtF,iCAAiC,iBAAiB,CAAC,IAAI,yCAAyC;gBAChG,yFAAyF;gBACzF,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,iGAAiG;QACjG,iGAAiG;QACjG,iGAAiG;QACjG,mGAAmG;QACnG,gGAAgG;QAChG,iEAAiE;QACjE,EAAE;QACF,gGAAgG;QAChG,kGAAkG;QAClG,4BAA4B;QAC5B,IAAI,mBAAmB,IAAI,UAAU,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;YAC7D,MAAM,cAAc,GAAG,iBAAiB,CAAC,qBAA+B,CAAC;YACzE,IAAI,CAAC,CAAC,cAAc,IAAK,UAAU,CAAC,KAAiC,CAAC,EAAE,CAAC;gBACvE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gDAAgD,cAAc,WAAW;oBAC/F,kDAAkD,CACnD,CAAC;YACJ,CAAC;YACD,IAAI,cAAc,IAAI,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/D,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gDAAgD,cAAc,OAAO;oBAC3F,+FAA+F;oBAC/F,8FAA8F;oBAC9F,8FAA8F;oBAC9F,4FAA4F,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,EAAE;QACF,oFAAoF;QACpF,kGAAkG;QAClG,kGAAkG;QAClG,8FAA8F;QAC9F,iGAAiG;QACjG,kFAAkF;QAClF,EAAE;QACF,iGAAiG;QACjG,iFAAiF;QACjF,EAAE;QACF,iGAAiG;QACjG,8FAA8F;QAC9F,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,MAAM,CAAC,kBAAkB,EAAE,IAAI,KAAK,wBAAwB,CAAC,SAAS,EAAE,CAAC;gBAC3E,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,uDAAuD;oBAC7E,+FAA+F;oBAC/F,6FAA6F;oBAC7F,uEAAuE,CACxE,CAAC;YACJ,CAAC;YACD,2BAA2B,GAAG;gBAC5B,GAAG,2BAA2B;gBAC9B,IAAI,EAAE,wBAAwB,CAAC,OAAO;aACvC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,sCAAsC;IACtC,2CAA2C;IAC3C,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,0FAA0F;IAC1F,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,0BAA0B;IAC1B,EAAE;IACF,gGAAgG;IAChG,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,wEAAwE;IACxE,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,kGAAkG;IAClG,0BAA0B;IAC1B,IAAI,WAAW,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC9F,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAA2B,CAAC,CAAC;YAChE,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,YAAY,SAAS,0BAA0B,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;oBACpH,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,sCAAsC;oBAC7H,8FAA8F;oBAC9F,qGAAqG;oBACrG,iGAAiG,CAClG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,mCAAmC;IACnC,2CAA2C;IAE3C,MAAM,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,GAAG,8BAA8B,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAC;IAE5J,2CAA2C;IAC3C,uDAAuD;IACvD,2CAA2C;IAE3C,uFAAuF;IACvF,sDAAsD;IACtD,wEAAwE;IACxE,MAAM,oBAAoB,GAAG,2BAA2B;QACtD,CAAC,CAAC,qBAAqB,CAAC,wCAAwC,CAC5D,mBAA4D,EAC5D,2BAA4H,CAC7H;QACH,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;IAEnE,2CAA2C;IAC3C,mDAAmD;IACnD,2CAA2C;IAE3C,MAAM,UAAU,GAA6F,EAAE,CAAC;IAEhH,iDAAiD;IACjD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IAC/C,MAAM,gBAAgB,GAAG,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC;IACjD,MAAM,gBAAgB,GAAG,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC;IACjD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,eAAe;IACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,eAAe;IACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,eAAe;IACnF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,eAAe;IAEnF,mCAAmC;IACnC,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAqI,EAAE,CAAC;QAC9M,6BAA6B,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE5F,qEAAqE;QACrE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAyG,CAAC;QAExI,+BAA+B;QAC/B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAChC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7C,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC9C,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,KAAK,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YACpE,IAAI,CAAC,+BAA+B,CAAC,WAAW,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9E,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CACxD,OAAO,CAAC,SAAS,KAAK,IAAI,CAC3B,CAAC;gBACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,wBAAwB,CAAC,cAAc,SAAS,mBAAmB,WAAW,sDAAsD,CAAC,CAAC;gBAC9I,CAAC;gBACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,wBAAwB,CAAC,cAAc,SAAS,mBAAmB,WAAW,4DAA4D,CAAC,CAAC;gBACpJ,CAAC;YACH,CAAC;YAED,IAAI,+BAA+B,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjD,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;oBACpC,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,yEAAyE;oBACzE,2EAA2E;oBAC3E,qEAAqE;oBACrE,6EAA6E;oBAC7E,8EAA8E;oBAC9E,6EAA6E;oBAC7E,2DAA2D;oBAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACjD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,wBAAwB,WAAW,uCAAuC;4BACjG,kGAAkG;4BAClG,yFAAyF;4BACzF,oGAAoG;4BACpG,4EAA4E,CAC7E,CAAC;oBACJ,CAAC;oBACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;wBACvB,6BAA6B,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;oBACrF,CAAC;oBACD,IAAI,OAAO,CAAC,UAAU,IAAI,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;wBAChG,MAAM,wBAAwB,CAC5B,cAAc,SAAS,qCAAqC,OAAO,CAAC,UAAU,GAAG,CAClF,CAAC;oBACJ,CAAC;oBACD,IAAI,OAAO,CAAC,UAAU,IAAI,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAiF,CAAC;2BACrK,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,EAC1D,CAAC;wBACD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,8CAA8C,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,mCAAmC,CACzI,CAAC;oBACJ,CAAC;oBACD,IAAI,OAAO,CAAC,UAAU,IAAI,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAiF,CAAC;2BACrK,CAAC,uCAAuC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,EACvE,CAAC;wBACD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,sCAAsC,OAAO,CAAC,UAAU,2CAA2C,CAC3H,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,+BAA+B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACpH,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;QACpG,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,yBAAyB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3C,MAAM,wBAAwB,CAC5B,cAAc,SAAS,gFAAgF,CACxG,CAAC;YACJ,CAAC;YACD,IAAI,yBAAyB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,wBAAwB,CAC5B,cAAc,SAAS,uGAAuG,CAC/H,CAAC;YACJ,CAAC;QACH,CAAC;QACD,mFAAmF;QACnF,uFAAuF;QACvF,wFAAwF;QACxF,yFAAyF;QACzF,kFAAkF;QAClF,kFAAkF;QAClF,6EAA6E;QAC7E,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,MAAM,KAAK,CAAC;YAC7D,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC;YACpE,CAAC,CAAC,yBAAyB,CAAC;QAE9B,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/C,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,MAAM,aAAa,GAAG,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAEjE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,MAAM,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAC9D,IAAI,oBAAoB,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBACnD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,8BAA8B,OAAO,CAAC,UAAU,+BAA+B,CACvG,CAAC;gBACJ,CAAC;gBACD,oBAAoB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACxB,MAAM,wBAAwB,CAC5B,cAAc,SAAS,yEAAyE,CACjG,CAAC;YACJ,CAAC;QAEH,CAAC;QAEC,6EAA6E;QAC7E,MAAM,8BAA8B,GAAG,iDAAiD,CACtF,8BAA8B,EAC9B,4BAA4B,EAC5B,MAAM,CAAC,0CAA0C,IAAI,EAAE,EACvD,SAAmB,CACpB,CAAC;QAEF,mDAAmD;QACnD,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,MAAM,CAAC,iBAAiB,IAAI,EAAE,EAC9B,kBAAkB,EAClB,SAAS,EACT,oBAAoB,CACrB,CAAC;QAEF,iDAAiD;QACjD,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAC7B,kBAAkB,EAClB,SAAS,CACV,CAAC;QAEJ,sDAAsD;QACtD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE;YACtD,sGAAsG;YACtG,iDAAiD;YAEjD,kEAAkE;YAClE,wEAAwE;YACxE,mEAAmE;YACnE,MAAM,kBAAkB,GAAG,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC/E,MAAM,kBAAkB,GAAG,+BAA+B,CAAC,aAAa,CAAC,WAAW,CAAC;gBACnF,CAAC,CAAC,gCAAgC,CAAC,iBAAiB,EAAE,aAAa,CAAC;gBACpE,CAAC,CAAC,gCAAgC,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;YAExE,mDAAmD;YACnD,kFAAkF;YAClF,MAAM,iBAAiB,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAgB,CAAC,CAAC;YACrE,MAAM,wBAAwB,GAAG,iBAAiB;gBAChD,CAAC,CAAC,CAAC,aAAa,CAAC,qBAAqB,IAAI,SAAS,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;YAEd,2EAA2E;YAC3E,mEAAmE;YACnE,yEAAyE;YACzE,2EAA2E;YAC3E,wEAAwE;YACxE,qEAAqE;YACrE,qDAAqD;YACrD,4EAA4E;YAC5E,4EAA4E;YAC5E,wEAAwE;YACxE,kDAAkD;YAClD,EAAE;YACF,sEAAsE;YACtE,4EAA4E;YAC5E,4EAA4E;YAC5E,uEAAuE;YACvE,2EAA2E;YAC3E,2EAA2E;YAC3E,IAAI,iBAAiB,IAAI,CAAE,aAAiD,CAAC,iBAAiB;mBACzF,CACD,aAAa,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,MAAM;uBACjE,aAAa,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,WAAW;uBACzE,aAAa,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,KAAK,CACvE,EACD,CAAC;gBACD,OAAO,CAAC,IAAI,CACV,6CAA6C,MAAM,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI;sBAC9F,WAAW,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,6CAA6C;sBACnG,+FAA+F;sBAC/F,gGAAgG;sBAChG,yEAAyE,CAC5E,CAAC;YACJ,CAAC;YAED,oEAAoE;YACpE,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,wBAAkC,EAClC,mBAAmB,EACnB,aAAa,CAAC,UAAU,CACzB,CAAC;YAEF,kDAAkD;YAClD,gEAAgE;YAChE,8DAA8D;YAC9D,4DAA4D;YAC5D,4CAA4C;YAC5C,MAAM,iBAAiB,GAAG,GAAiB,EAAE;gBAC3C,IAAK,aAAqB,CAAC,iBAAiB,EAAE,CAAC;oBAC7C,OAAQ,aAAqB,CAAC,iBAAiB,CAAC;gBAClD,CAAC;gBACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI;uBACtC,aAAqB,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,IAAI,EAAE,CAAC;oBACjF,OAAO,oBAAoB,CAAC;gBAC9B,CAAC;gBACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,MAAM;uBACxC,aAAqB,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,MAAM,EAAE,CAAC;oBACnF,OAAO,oBAAoB,CAAC;gBAC9B,CAAC;gBACD,OAAO,mBAAmB,CAAC;YAC7B,CAAC,CAAC;YAEF,mGAAmG;YACnG,MAAM,oBAAoB,GAAG,iBAAiB,EAAE,CAAC;YAEjD,6DAA6D;YAC7D,2FAA2F;YAC3F,oFAAoF;YACpF,gFAAgF;YAChF,MAAM,mBAAmB,GAAG;gBAC1B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,mBAAmB;gBAC/B,oBAAoB;gBACpB,kBAAkB;gBAClB,uBAAuB;gBACvB,qBAAqB,EAAE,8BAA8B;gBACrD,gBAAgB;gBAChB,mBAAmB,EAAE,SAAS;gBAC9B,kBAAkB;gBAClB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,oCAAoC,CAAC,MAAM;gBAC5F,UAAU,EAAE,iBAAiB,EAAE,wDAAwD;gBACvF,WAAW,EAAE,oBAAoB,EAAE,wDAAwD;gBAC3F,4EAA4E;gBAC5E,iFAAiF;gBACjF,8EAA8E;gBAC9E,iFAAiF;gBACjF,gFAAgF;gBAChF,mBAAmB,EAAE,CAAC,CAAE,aAAqB,CAAC,UAAU;gBACxD,oBAAoB,EAAE,CAAC,CAAE,aAAqB,CAAC,iBAAiB;gBAChE,2BAA2B,EAAE,MAAM,CAAC,2BAA2B,IAAI,EAAE;gBACrE,iBAAiB;gBACjB,gBAAgB;gBAChB,qFAAqF;gBACrF,yFAAyF;gBACzF,2EAA2E;gBAC3E,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,0DAA0D;gBAC1D,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;gBAC1D,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;gBACpD,sFAAsF;gBACtF,0FAA0F;gBAC1F,wFAAwF;gBACxF,uFAAuF;gBACvF,gBAAgB,EAAG,aAAqB,CAAC,gBAAgB;gBACzD,gBAAgB,EAAE,yBAAyB,CAAC,aAAa,CAAC,gBAAgB,CAAC;gBAC3E,SAAS,EAAE,aAAa,CAAC,SAAS,IAAI,0BAA0B,CAAC,GAAG;gBACpE,2FAA2F;gBAC3F,yFAAyF;gBACzF,2EAA2E;gBAC3E,sBAAsB,EAAE,aAAa,CAAC,sBAAsB;gBAC5D,KAAK,EAAE,aAAa,CAAC,KAAK;gBAC1B,wFAAwF;gBACxF,sFAAsF;gBACtF,kFAAkF;gBAClF,yBAAyB;gBACzB,4BAA4B,EAAE,aAAa,CAAC,4BAA4B;gBACxE,4FAA4F;gBAC5F,2FAA2F;gBAC3F,2CAA2C;gBAC3C,4BAA4B,EAAE,aAAa,CAAC,4BAA4B;gBACxE,uCAAuC,EAAE,aAAa,CAAC,uCAAuC;gBAC9F,4FAA4F;gBAC5F,oFAAoF;gBACpF,oCAAoC,EAAE,aAAa,CAAC,oCAAoC;gBACxF,uFAAuF;gBACvF,4FAA4F;gBAC5F,8FAA8F;gBAC9F,cAAc,EAAE,aAAa,CAAC,cAAc;gBAC5C,GAAG,EAAE,aAAa,CAAC,GAAG;gBACtB,gCAAgC,EAAE,aAAa,CAAC,gCAAgC,IAAI,EAAE;gBACtF,oBAAoB,EAAE,aAAa,CAAC,oBAAoB;gBACxD,4FAA4F;gBAC5F,2FAA2F;gBAC3F,4EAA4E;gBAC5E,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;gBACtD,2FAA2F;gBAC3F,0FAA0F;gBAC1F,4FAA4F;gBAC5F,6FAA6F;gBAC7F,0FAA0F;gBAC1F,+CAA+C;gBAC/C,oBAAoB,EAAE,aAAa,CAAC,oBAAoB;aACzD,CAAC;YAIF,IAAI,+BAA+B,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/D,MAAM,aAAa,GAAG,aAErB,CAAC;gBACF,MAAM,iBAAiB,GAAG,aAAa,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CAAC;gBAC5G,MAAM,cAAc,GAAG,aAItB,CAAC;gBAEF,yEAAyE;gBACzE,MAAM,iBAAiB,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAgB,CAAC,CAAC;gBACrE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;gBAE7F,gFAAgF;gBAChF,MAAM,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,IAAI,KAAK,CAAC;gBACnE,IAAI,iBAAiB,IAAI,CAAC,gBAAgB,KAAK,qBAAqB,CAAC,IAAI,IAAI,gBAAgB,KAAK,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9H,MAAM,wBAAwB,CAAC,cAAc,SAAS,gEAAgE,CAAC,CAAC;gBAC1H,CAAC;gBACD,MAAM,qBAAqB,GAAG;oBAC5B,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC;gBACF,IACE,qBAAqB,CAAC,MAAM,GAAG,CAAC;uBAC7B,CACD,iBAAiB;2BACd,sCAAsC,CAAC,gBAAgB,CAAC,CAC5D,EACD,CAAC;oBACD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,0DAA0D,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;0BACpH,gHAAgH;0BAChH,gHAAgH;0BAChH,kDAAkD,CACvD,CAAC;gBACJ,CAAC;gBACD,IAAI,aAAa,CAAC,eAAe,IAAI,gBAAgB,KAAK,qBAAqB,CAAC,MAAM,EACpF,CAAC;oBACD,MAAM,wBAAwB,CAC5B,cAAc,SAAS,6FAA6F;0BAChH,4EAA4E,CACjF,CAAC;gBACJ,CAAC;gBAED,yEAAyE;gBACzE,IAAI,QAAoB,CAAC;gBACzB,IAAI,iBAAiB,EAAE,CAAC;oBACtB,qFAAqF;oBACrF,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC;wBACzC,MAAM,wBAAwB,CAAC,cAAc,SAAS,gEAAgE,CAAC,CAAC;oBAC1H,CAAC;oBACD,QAAQ,GAAG,8BAA8B,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;gBACjF,CAAC;qBAAM,CAAC;oBACN,gDAAgD;oBAChD,QAAQ,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;gBACvD,CAAC;gBAID,gDAAgD;gBAChD,IAAI,aAAa,CAAC,eAAe,EAAE,CAAC;oBAClC,6BAA6B,CAC3B,aAAa,CAAC,eAAe,EAC7B,kBAA4B,EAC5B,SAAmB,CACpB,CAAC;gBACJ,CAAC;gBACD,IAAI,aAAa,CAAC,eAAe,EAAE,CAAC;oBAClC,6BAA6B,CAC3B,aAAa,CAAC,eAAe,EAC7B,kBAA4B,EAC5B,SAAmB,CACpB,CAAC;gBACJ,CAAC;gBAED,MAAM,sBAAsB,GAAG;oBAC7B,GAAG,mBAAmB;oBACtB,QAAQ;oBACR,sBAAsB,EAAE,aAAa,CAAC,sBAAsB,IAAI,KAAK;oBACrE,eAAe,EAAE,KAAK,EAAE,mBAAmB;oBAC3C,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;oBACtD,eAAe,EAAE,aAAa,CAAC,eAAe;oBAC9C,eAAe,EAAE,aAAa,CAAC,eAAe;oBAC9C,qDAAqD;oBACrD,+DAA+D;oBAC/D,oEAAoE;oBACpE,oEAAoE;oBACpE,4BAA4B;oBAC5B,SAAS,EAAE,aAAa,CAAC,SAAS;oBAClC,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;oBAChD,SAAS,EAAE,aAAa,CAAC,SAAS;oBAClC,UAAU,EAAE,aAAa,CAAC,UAAU;oBACpC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;wBACtB,WAAW,EAAE,cAAc,CAAC,WAAW;wBACvC,eAAe,EAAE,cAAc,CAAC,eAAe,IAAI,GAAG;wBACtD,qBAAqB,EAAE,cAAc,CAAC,qBAAqB,IAAI,CAAC;qBACjE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;gBAEF,mEAAmE;gBACnE,wFAAwF;gBACxF,sFAAsF;gBACtF,MAAM,YAAY,GAAG,SAAS,KAAK,qBAAqB,CAAC,MAAM;uBACzD,aAAqB,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,MAAM,CAAC;gBACnF,MAAM,UAAU,GAAG,SAAS,KAAK,qBAAqB,CAAC,IAAI;uBACrD,aAAqB,CAAC,qBAAqB,KAAK,qBAAqB,CAAC,IAAI,CAAC;gBAEjF,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,QAAQ,GAAI,aAAqB,CAAC,QAAQ,IAAI,EAAE,CAAC;oBACvD,MAAM,YAAY,GAAI,aAAqB,CAAC,YAAY,KAAK,KAAK,CAAC;oBACnE,MAAM,gBAAgB,GAAI,aAAqB,CAAC,gBAAgB,IAAI,EAAE,CAAC;oBACvE,MAAM,iBAAiB,GAAI,aAAqB,CAAC,iBAAiB,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;oBACrH,MAAM,eAAe,GAAI,aAAqB,CAAC,YAAY,IAAI,EAAE,CAAC;oBAClE,MAAM,UAAU,GAAI,aAAqB,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC3D,MAAM,8BAA8B,GAAI,aAAqB,CAAC,8BAA8B,IAAI,EAAE,CAAC;oBAEnG,MAAM,YAAY,GAAqC,EAAE,CAAC;oBAC1D,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;wBACvD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;4BAChC,YAAY,CAAC,GAAG,CAAC,GAAG,KAAyB,CAAC;wBAChD,CAAC;oBACH,CAAC,CAAC,CAAC;oBAEH,MAAM,wBAAwB,GAAG,sCAAsC,CAAC;wBACtE,YAAY;wBACZ,iBAAiB,EAAE,UAAU;wBAC7B,UAAU,EAAE,IAAI;wBAChB,sFAAsF;wBACtF,8DAA8D;wBAC9D,8BAA8B;qBAC/B,CAAC,CAAC;oBAEH,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;wBACpE,UAAU,EAAE,oBAAoB;wBAChC,wBAAwB,EAAE,IAAI;wBAC9B,sBAAsB,EAAE,8BAA8B;qBACvD,CAAC,CAAC;oBAEH,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE;wBACpC,QAAQ;wBACR,YAAY;wBACZ,gBAAgB;wBAChB,iBAAiB;wBACjB,YAAY,EAAE,eAAe;wBAC7B,UAAU;wBACV,8BAA8B;wBAC9B,wBAAwB;wBACxB,WAAW,EAAE,uBAAuB;wBACpC,oBAAoB,EAAE,KAAK;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,cAAc,GAA4B;wBAC9C,QAAQ,EAAG,aAAqB,CAAC,QAAQ,IAAI,EAAE;wBAC/C,aAAa,EAAG,aAAqB,CAAC,aAAa,IAAI,IAAI;wBAC3D,cAAc,EAAG,aAAqB,CAAC,cAAc,IAAI,IAAI;wBAC7D,gFAAgF;wBAChF,+EAA+E;wBAC/E,oFAAoF;wBACpF,8BAA8B,EAAG,aAAqB,CAAC,8BAA8B,IAAI,GAAG;qBAC7F,CAAC;oBACF,IAAK,aAAqB,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;wBACtD,cAAc,CAAC,YAAY,GAAI,aAAqB,CAAC,YAAY,CAAC;oBACpE,CAAC;oBACD,IAAK,aAAqB,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;wBACpD,cAAc,CAAC,UAAU,GAAI,aAAqB,CAAC,UAAU,CAAC;oBAChE,CAAC;oBACD,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAC;gBACxD,CAAC;gBACD,mEAAmE;gBAEnE,uBAAuB;gBACvB,UAAU,CAAC,IAAI,CAAC,sBAAgH,CAAC,CAAC;gBAElI,gCAAgC;gBAChC,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;wBACpB,IAAI,gBAAgB,KAAK,qBAAqB,CAAC,MAAM,EAAE,CAAC;4BACtD,OAAO,sBAAsB,CAAC,UAAU,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gCAC5F,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;oCACP,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,UAAU,CAAC;iCACjD,CAAC;gCACJ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;oCACP,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;iCAC5B,CAAC,CAAC;wBACT,CAAC;wBAED,IAAI,sBAAsB,CAAC,UAAU,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;4BAC7D,OAAO,iCAAiC,CAAC,MAAM,CAC7C,iBAAiB,CAAC,sBAAsB,CAAC,UAAU,CAAC,CACrD,CAAC;wBACJ,CAAC;wBAED,OAAO,sBAAsB,CAAC,UAAU,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;4BAC5F,CAAC,CAAC,iCAAiC,CAAC,GAAG,CAAC,sBAAsB,CAAC,UAAU,CAAC;4BAC1E,CAAC,CAAC,iCAAiC,CAAC;oBACxC,CAAC,CAAC,EAAE,CAAC;oBAEL,MAAM,mBAAmB,GAAG;wBAC1B,GAAG,sBAAsB;wBACzB,eAAe,EAAE,IAAI;wBACrB,kBAAkB,EAAE,KAAK,EAAE,oCAAoC;wBAC/D,UAAU,EAAE,OAAO;qBACpB,CAAC;oBAEF,UAAU,CAAC,IAAI,CAAC,mBAA6G,CAAC,CAAC;gBACjI,CAAC;YAEH,CAAC;iBAAM,CAAC;gBACN,+EAA+E;gBAC/E,MAAM,EAAE,WAAW,EAAE,GAAG,cAAc,EAAE,GAAG,aAAa,CAAC,CAAC,mCAAmC;gBAE7F,MAAM,mBAAmB,GAAG;oBAC1B,GAAG,mBAAmB;oBACtB,GAAG,cAAc;iBAClB,CAAC;gBAEF,UAAU,CAAC,IAAI,CAAC,mBAA6G,CAAC,CAAC;YACjI,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,2CAA2C;QAC3C,0CAA0C;QAC1C,2CAA2C;QAE3C,+DAA+D;QAC/D,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,EAAE,CAAC;YACzF,sFAAsF;YACtF,gEAAgE;YAChE,MAAM,qBAAqB,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAC1E,SAAS,CAAC,mBAAmB,KAAK,SAAS;mBACxC,+BAA+B,CAAC,SAAS,CAAC,WAAW,CAAC;mBACtD,SAAS,CAAC,kBAAkB,KAAK,IAAI;mBACrC,CAAC,CAAC,iBAAiB,IAAI,SAAS,IAAI,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,CAC3E,CAMY,CAAC;YAEd,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC3B,kDAAkD;gBAClD,SAAS;YACX,CAAC;YAED,MAAM,2BAA2B,GAAG,qBAAiF,CAAC;YAEtH,qCAAqC;YACrC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAC7B,SAAS,CAAC,mBAAmB,KAAK,SAAS;mBACxC,+BAA+B,CAAC,SAAS,CAAC,WAAW,CAAC;mBACtD,SAAS,CAAC,UAAU;mBACpB,CAAC,CAAC,iBAAiB,IAAI,SAAS,IAAI,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,CAC3E,CAAC;iBACD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAW,CAAC,WAAW,EAAE,CAAC,CAC3D,CAAC;YAEF,0CAA0C;YAC1C,+FAA+F;YAC/F,gFAAgF;YAChF,MAAM,0BAA0B,GAAG,CACjC,UAAuF,EACvF,WAAyB,EACzB,SAAkB,EACsE,EAAE;gBAC1F,MAAM,mBAAmB,GAAG;oBAC1B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;oBACtC,UAAU,EAAE,mBAAmB;oBAC/B,oBAAoB;oBACpB,kBAAkB;oBAClB,uBAAuB;oBACvB,qBAAqB,EAAE,8BAA8B;oBACrD,gBAAgB;oBAChB,mBAAmB,EAAE,SAAS;oBAC9B,kBAAkB,EAAE,KAAK,EAAE,4CAA4C;oBACvE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,oCAAoC,CAAC,MAAM;oBAC5F,UAAU,EAAE,qBAAqB,CAAC,UAAU,IAAI,gBAAgB,CAAC,SAAmB,EAAE,mBAAmB,EAAE,SAAS,CAAC,EAAE,wDAAwD;oBAC/K,yFAAyF;oBACzF,yFAAyF;oBACzF,iFAAiF;oBACjF,6EAA6E;oBAC7E,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB,IAAI,CAAC,CAAC,qBAAqB,CAAC,UAAU;oBACpG,WAAW,EAAE,wDAAwD;oBACrE,2BAA2B,EAAE,MAAM,CAAC,2BAA2B,IAAI,EAAE;oBACrE,iBAAiB;oBACjB,gBAAgB;oBAChB,WAAW,EAAE,qBAAqB,CAAC,WAAW;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,qBAAqB;oBAClE,gBAAgB,EAAE,yBAAyB,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;oBACnF,SAAS,EAAE,qBAAqB,CAAC,SAAS,IAAI,0BAA0B,CAAC,GAAG;oBAC5E,wFAAwF;oBACxF,uFAAuF;oBACvF,0EAA0E;oBAC1E,sBAAsB,EAAE,qBAAqB,CAAC,sBAAsB;oBACpE,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,qCAAqC;oBACzE,iFAAiF;oBACjF,iFAAiF;oBACjF,6EAA6E;oBAC7E,4BAA4B,EAAE,qBAAqB,CAAC,4BAA4B;oBAChF,yFAAyF;oBACzF,sFAAsF;oBACtF,wFAAwF;oBACxF,0FAA0F;oBAC1F,uBAAuB;oBACvB,4BAA4B,EAAE,qBAAqB,CAAC,4BAA4B;oBAChF,uCAAuC,EAAE,qBAAqB,CAAC,uCAAuC;oBACtG,6FAA6F;oBAC7F,6FAA6F;oBAC7F,gEAAgE;oBAChE,oCAAoC,EAAE,qBAAqB,CAAC,oCAAoC;oBAChG,yFAAyF;oBACzF,2FAA2F;oBAC3F,wFAAwF;oBACxF,2FAA2F;oBAC3F,cAAc,EAAE,qBAAqB,CAAC,cAAc;oBACpD,GAAG,EAAE,qBAAqB,CAAC,GAAG,EAAE,gGAAgG;oBAChI,gCAAgC,EAAE,qBAAqB,CAAC,gCAAgC,IAAI,EAAE;oBAC9F,oBAAoB,EAAE,qBAAqB,CAAC,oBAAoB;oBAChE,wFAAwF;oBACxF,4EAA4E;oBAC5E,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;oBAC9D,2FAA2F;oBAC3F,6FAA6F;oBAC7F,yFAAyF;oBACzF,qFAAqF;oBACrF,oBAAoB,EAAE,qBAAqB,CAAC,oBAAoB;oBAChE,QAAQ,EAAE,qBAAqB,CAAC,QAAQ;oBACxC,sBAAsB,EAAE,qBAAqB,CAAC,sBAAsB,IAAI,KAAK;oBAC7E,eAAe,EAAE,KAAK;oBACtB,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;oBAC9D,eAAe,EAAE,qBAAqB,CAAC,eAAe;oBACtD,eAAe,EAAE,qBAAqB,CAAC,eAAe;oBACtD,8DAA8D;oBAC9D,gEAAgE;oBAChE,mEAAmE;oBACnE,iEAAiE;oBACjE,wEAAwE;oBACxE,SAAS,EAAE,qBAAqB,CAAC,SAAS;oBAC1C,gBAAgB,EAAE,qBAAqB,CAAC,gBAAgB;oBACxD,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,UAAU;oBACtB,GAAG,CAAC,SAAS,KAAK,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;wBAC7C,uFAAuF;wBACvF,yFAAyF;wBACzF,uFAAuF;wBACvF,sDAAsD;wBACtD,QAAQ,EAAE,2BAA2B,CAAC,QAAQ;wBAC9C,aAAa,EAAE,2BAA2B,CAAC,aAAa;wBACxD,cAAc,EAAE,2BAA2B,CAAC,cAAc;wBAC1D,YAAY,EAAE,2BAA2B,CAAC,YAAY;wBACtD,UAAU,EAAE,2BAA2B,CAAC,UAAU;wBAClD,8BAA8B,EAAE,2BAA2B,CAAC,8BAA8B;qBAC3F,CAAC,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,qBAAqB,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CAAC,CAAC,CAAC;wBAC9F,WAAW,EAAE,qBAAqB,CAAC,WAAW;wBAC9C,eAAe,EAAE,qBAAqB,CAAC,eAAe;wBACtD,qBAAqB,EAAE,qBAAqB,CAAC,qBAAqB;qBACnE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;gBAEF,6DAA6D;gBAC7D,IAAI,qBAAqB,CAAC,eAAe,EAAE,CAAC;oBAC1C,6BAA6B,CAC3B,qBAAqB,CAAC,eAAe,EACrC,kBAA4B,EAC5B,GAAG,SAAmB,IAAI,UAAU,EAAE,CACvC,CAAC;gBACJ,CAAC;gBACD,IAAI,qBAAqB,CAAC,eAAe,EAAE,CAAC;oBAC1C,6BAA6B,CAC3B,qBAAqB,CAAC,eAAe,EACrC,kBAA4B,EAC5B,GAAG,SAAmB,IAAI,UAAU,EAAE,CACvC,CAAC;gBACJ,CAAC;gBAED,OAAO,mBAA6G,CAAC;YACvH,CAAC,CAAC;YAEF,gCAAgC;YAChC,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,IAAI,iBAAiB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7H,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;gBAChD,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;YACxG,CAAC;YAED,gCAAgC;YAChC,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,IAAI,iBAAiB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7H,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,CAAC,0BAA0B;gBAC1E,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;YACxG,CAAC;YAED,gCAAgC;YAChC,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,IAAI,iBAAiB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7H,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;oBAC/D,UAAU,EAAE,oBAAoB;oBAChC,wBAAwB,EAAE,IAAI;oBAC9B,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;iBACnF,CAAC,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;YACxG,CAAC;YAED,gCAAgC;YAChC,IAAI,SAAS,KAAK,qBAAqB,CAAC,IAAI,IAAI,iBAAiB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7H,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;oBAC/D,UAAU,EAAE,mBAAmB;oBAC/B,wBAAwB,EAAE,IAAI;oBAC9B,sBAAsB,EAAE,2BAA2B,CAAC,8BAA8B;iBACnF,CAAC,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;YACxG,CAAC;QACH,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,wCAAwC;IACxC,2CAA2C;IAE3C,6GAA6G;IAC7G,6FAA6F;IAC7F,oEAAoE;IACpE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC/E,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE7C,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,iBAAiB,IAAI,EAAE,IAAI,EAAE,CAAC,eAAe,EAAE,oBAAoB,IAAI,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC;YACxG,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,SAAmB,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,qBAAqB,IAAI,EAAE,IAAI,EAAE,CAAC,mBAAmB,EAAE,MAAM,KAAK,yBAAyB,CAAC,QAAQ,EAAE,CAAC;YACzG,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;gBAC7C,kBAAkB,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACzD,IAAI,SAAS,KAAK,UAAU,IAAI,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gBAAgB,SAAS,mDAAmD;gBAClG,mGAAmG;gBACnG,8FAA8F,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,qBAAqB;IACrB,2CAA2C;IAE3C,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CACV,IAAI,kBAAkB,sEAAsE;gBAC5F,yEAAyE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,UAAU,CAAC,IAAI,CACb,GAAG,yCAAyC,CAC1C,UAAU,EACV,qBAAqB,EACrB,kBAAkB,EAClB;QACE,GAAG,kCAAkC;QACrC,CAAC,kBAAkB,CAAC,EAAE,uBAAuB;KAC9C,CACF,CACF,CAAC;IAEF,MAAM,4BAA4B,GAAG,yCAAyC,CAAC,0BAA0B,CACvG,mBAAmB,EACnB,2BAA2B,CAC5B,CAAC;IAEF,UAAU,CAAC,IAAI,CACb,GAAG,uCAAuC,CAAC;QACzC,UAAU;QACV,kBAAkB;QAClB,uBAAuB;QACvB,UAAU,EAAE,mBAAmB;QAC/B,4BAA4B;QAC5B,kBAAkB;KACnB,CAAC,CACH,CAAC;IAEF,2FAA2F;IAC3F,kGAAkG;IAClG,iGAAiG;IACjG,yBAAyB;IACzB,UAAU,CAAC,IAAI,CACb,GAAG,yCAAyC,CAAC;QAC3C,UAAU;QACV,kBAAkB;KACnB,CAAC,CACH,CAAC;IAEF,2EAA2E;IAC3E,EAAE;IACF,8EAA8E;IAC9E,gFAAgF;IAChF,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,EAAE;IACF,oEAAoE;IACpE,6EAA6E;IAC7E,4EAA4E;IAC5E,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,4EAA4E;QAC5E,mEAAmE;QACnE,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,uEAAuE;QACvE,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,wEAAwE;QACxE,2EAA2E;QAC3E,mBAAmB;QACnB,MAAM,cAAc,GAClB,2BAA2B,CAAC,SAAS,CAAC,mBAAmB,CAAC;eACvD,CAAC,iBAAiB,IAAI,SAAS,IAAI,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC;QAC5E,IAAI,cAAc,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAChE,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,gBAAgB,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,8BAA8B;gBACzG,qGAAqG;gBACrG,kGAAkG;gBAClG,2EAA2E,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,EAAE;IACF,sFAAsF;IACtF,6FAA6F;IAC7F,4FAA4F;IAC5F,EAAE;IACF,iEAAiE;IACjE,0FAA0F;IAC1F,6FAA6F;IAC7F,8FAA8F;IAC9F,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,gGAAgG;IAChG,8DAA8D;IAC9D,EAAE;IACF,yFAAyF;IACzF,6FAA6F;IAC7F,wFAAwF;IACxF,8FAA8F;IAC9F,4DAA4D;IAC5D,IAAI,eAAe,EAAE,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,gDAAgD,EAAE,CAAC;YAC3G,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,mCAAmC,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;gBACtG,SAAS;YACX,CAAC;YAED,MAAM,gBAAgB,GAAG,UAAU;iBAChC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,mBAAmB,KAAK,iBAAiB,CAAC;iBAC1E,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrG,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAE3D,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,8BAA8B,iBAAiB,oCAAoC;gBACzG,sEAAsE;gBACtE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,6BAA6B;gBACnG,GAAG,SAAS,sFAAsF;gBAClG,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC;gBAC7F,gGAAgG;gBAChG,+FAA+F;gBAC/F,qBAAqB,4BAA4B,CAAC,aAAa,mCAAmC;gBAClG,iGAAiG;gBACjG,oGAAoG,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,EAAE;IACF,gGAAgG;IAChG,+FAA+F;IAC/F,2EAA2E;IAC3E,6FAA6F;IAC7F,oCAAoC;IACpC,EAAE;IACF,qFAAqF;IACrF,gGAAgG;IAChG,uFAAuF;IACvF,EAAE;IACF,iGAAiG;IACjG,0FAA0F;IAC1F,uFAAuF;IACvF,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,mDAAmD,EAAE,CAAC;YAC/G,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CACpC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,mCAAmC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/F,SAAS;YACX,CAAC;YAED,MAAM,gBAAgB,GAAG,UAAU;iBAChC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAA4C,CAAC,CAAC;iBACpG,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE;gBACrF,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAEpH,MAAM,wBAAwB,CAC5B,IAAI,kBAAkB,mCAAmC,6BAA6B,CAAC,YAAY,CAAC,GAAG;gBACvG,4FAA4F;gBAC5F,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,2BAA2B;gBACjG,aAAa,SAAS,KAAK,GAAG,mEAAmE;gBACjG,SAAS,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC;gBAClG,gGAAgG;gBAChG,+FAA+F;gBAC/F,8CAA8C,4BAA4B,CAAC,aAAa,SAAS;gBACjG,gGAAgG,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAiF;QACnG,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;QACtC,oBAAoB;QACpB,kBAAkB;QAClB,uBAAuB;QACvB,cAAc;QACd,eAAe;QACf,UAAU,EAAE,mBAAmB;QAC/B,qBAAqB,EAAE,8BAA8B;QACrD,2BAA2B;QAC3B,kBAAkB;QAClB,2BAA2B;QAC3B,cAAc,EAAE,sBAAsB;QACtC,oBAAoB;QACpB,oBAAoB;QACpB,gBAAgB;QAChB,6BAA6B;QAC7B,kBAAkB,EAAE,2BAA2B;QAC/C,cAAc;QACd,mBAAmB,EAAE,cAAc;YACjC,CAAC,CAAC,CAAC,mBAAmB,IAAI,2BAA2B,CAAC,GAAG,CAAC;YAC1D,CAAC,CAAC,2BAA2B,CAAC,GAAG;QACnC,mGAAmG;QACnG,gFAAgF;QAChF,6FAA6F;QAC7F,2FAA2F;QAC3F,eAAe,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACpE,sGAAsG;QACtG,iBAAiB,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACxE,wFAAwF;QACxF,yFAAyF;QACzF,yFAAyF;QACzF,gEAAgE;QAChE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACvF,UAAU,EAAE,UAAU,CAAC,+BAA+B;KACvD,CAAC;IAEF,sEAAsE;IACtE,yFAAyF;IACzF,+EAA+E;IAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAqB,CAAC;IACtD,MAAM,kBAAkB,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CACpD,yCAAyC,CAAC,qBAAqB,CAC7D,SAAS,EACT,cAAc,EACd,gBAAgB,CACjB,CACF,CAAC;IAEF,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;QACtC,oBAAoB;QACpB,kBAAkB;QAClB,uBAAuB;QACvB,cAAc;QACd,eAAe;QACf,UAAU,EAAE,mBAAmB;QAC/B,qBAAqB,EAAE,8BAA8B;QACrD,2BAA2B;QAC3B,kBAAkB;QAClB,2BAA2B;QAC3B,cAAc,EAAE,sBAAsB;QACtC,oBAAoB;QACpB,oBAAoB;QACpB,gBAAgB;QAChB,6BAA6B;QAC7B,kBAAkB,EAAE,2BAA2B;QAC/C,cAAc;QACd,mBAAmB,EAAE,cAAc;YACjC,CAAC,CAAC,CAAC,mBAAmB,IAAI,2BAA2B,CAAC,GAAG,CAAC;YAC1D,CAAC,CAAC,2BAA2B,CAAC,GAAG;QACnC,kGAAkG;QAClG,+DAA+D;QAC/D,eAAe,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QACpE,sGAAsG;QACtG,iBAAiB,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACxE,wFAAwF;QACxF,yFAAyF;QACzF,yFAAyF;QACzF,gEAAgE;QAChE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;QACvF,UAAU,EAAE,kBAAkB;KAC/B,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Operations Shared Schemas\n *\n * Reusable operation schemas for bulk actions and common operations\n */\n\n\nimport {\n EnumLikeType,\n ExpiresInDurationSchema,\n PrimitiveZodType,\n getImpersonalizeMaskValue,\n getImpersonalizeTreatment,\n getZodObjectShape,\n getZodType,\n isBackendOnlyField,\n isDiscriminatorField,\n isExcludedFromCreate,\n isExcludedFromUpdate,\n isBusinessKeyField,\n isZodObject,\n isSummaryField,\n isTemplatableFileField,\n isUniqueField,\n isVirtualField,\n SingleFileValueSchema,\n toPatchOptionalField,\n mainSchemaFieldIsClearable,\n unwrapSchema,\n getDataCategories,\n} from '@wildo-ai/zod-decorators';\nimport { z } from 'zod';\nimport { ErrorType } from '../errors/errors.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind, RetentionStatus, RetentionStatusSchema } from '../compliance/privacy/impersonalization.shared.schemas';\nimport {\n buildImpersonalizeScrubPatch,\n collectDeclaredPersonalDataFields,\n IMPERSONALIZE_MASK_CONSTANT,\n isImpersonalizeNeverScrubFloorField,\n resolveImpersonalizeMaskValue,\n resolveImpersonalizeResetValue,\n} from '../compliance/privacy/impersonalization-scrub.shared.utils';\nimport { RedactionType } from '../compliance/privacy/redaction.shared.schemas';\nimport { unknownPersonalDataCategories } from '../compliance/privacy/personal-data-category.shared.schemas';\n/*\n * entrypoint-closure-waiver: this root-reachable module imports the external-data AUTHORING\n * contract, which only `@wildo-ai/saas-models/external-data` publishes (see\n * `external-data.exports.ts` for why that subpath exists).\n *\n * MEASURED SAFE 2026-08-29 by the probe `package-public-entrypoints.md` prescribes — a consumer\n * importing ONLY the package root, re-exporting these surfaces and deriving their parameter types\n * so declaration emit must WRITE them rather than alias them, compiled with `declaration: true`:\n * zero TS2742 / TS2883 / TS7056, and the emitted `.d.ts` names `@wildo-ai/saas-models` with no\n * `node_modules/...` path anywhere in it.\n *\n * The mechanism, so the next reader need not re-derive it: every crossing here is an EXPLICIT\n * ANNOTATION inside this package, so TypeScript emits a RELATIVE intra-package import in our own\n * `.d.ts` — which resolves by PATH for any consumer, whatever the exports map says. TS2742 bites\n * only when TypeScript must INVENT a specifier for an INFERRED type. Re-run the probe if a\n * root-exported contract here ever starts inferring one.\n */\nimport { HttpApiResourceBindingSchema, HttpApiTransportDialect, assertHttpApiBindingDialectCoherence } from '../http-api-binding/http-api-binding.shared.schemas';\nimport {\n ExternalDataDestinationPopulation,\n ExternalDataFieldCoercion,\n ExternalDataMappingEntryKind,\n ExternalDataPipelineDeclarationSchema,\n assertExternalDataPipelineDeclarationCoherence,\n} from '../external-data/external-data-pipeline.shared.schemas';\nimport {\n M2MNotificationDefinition,\n UserNotificationDefinition,\n} from '../notifications/notifications.shared.schemas';\nimport { HttpMethod } from '../requests/http-requests.shared';\nimport type { TokenGenerationConfig, TokenRevocationConfig } from '../security/authentications/consumable-token.shared.schemas';\nimport { ConsumableToken_ConsumptionMode, TokenAuthenticationPolicy } from '../security/authentications/consumable-token.shared.schemas';\nimport {\n OPERATION_VARIANT_KEY,\n type AnyResourceConfiguration,\n type CollectionViewFields_List,\n RequiredFeaturesConfig,\n RequiredFeaturesNormalized,\n Resources_BulkOperationBaseSchema,\n Resources_Filter_BaseSchema,\n Resources_Filter_DateRangeSchema,\n Resources_PaginationRequestSchema,\n createPaginationRequestSchema,\n createPaginationResponseMetadataSchema,\n ResourceConfiguration,\n ResourceConfiguration_Operation_ApiCall,\n ResourceConfiguration_Operation,\n ResourceConfiguration_OperationVariant_BuilderParameters,\n ResourceConfiguration_Operation_BuilderParameters,\n ResourceConfiguration_BuilderParameters,\n ResourceConfiguration_InheritanceSchemaDefinition,\n ResourceConfiguration_ResourceRelationships,\n ResourceGeneratedOperationKind,\n ResourcePaginatedResponseResultSchema,\n ResourceSearchQueryRequestResult,\n ResourceSystemAccessMode,\n PersistenceAdapter,\n isPersistenceAdapter,\n SortOrder,\n ValidOperationKeys,\n ResourceCollectionExportConfig,\n ResourceCollectionExportResponseSchema,\n} from './resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier, ResourceType } from './resources.shared.core.definitions';\nimport {\n PRIMARY_SCOPE_FIELD_IDENTIFIERS,\n PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE,\n FIELD_IDENTIFIER_TO_PRIMARY_SCOPE,\n RelationshipNature,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourceOperation_ServiceRuntimeMode,\n ResourceParentResourceRequirement,\n ResourcePrimaryScope,\n ResourceRelationship,\n ResourceRelationshipBulkAction,\n ResourceRelationshipBulkActionResultSchema,\n ResourceRelationshipBulkClearOperationRequestSchema,\n ResourceRelationshipBulkCreateOperationRequestSchema,\n ResourceRelationshipBulkLinkOperationRequestSchema,\n ResourceRelationshipBulkReplaceOperationRequestSchema,\n ResourceRelationshipBulkSetOperationRequestSchema,\n ResourceRelationshipBulkUnlinkOperationRequestSchema,\n ResourceRelationshipDeclaration,\n ResourceRelationshipAccessScopeStrategy,\n ResourceRelationshipCardinality,\n ResourceTranspositionPolicy\n} from './resources.shared.schemas';\n\nimport { createResourcesRelationship } from './resources-relationships.shared.factory';\nimport { Resources_SharedUtils } from './resources.shared.utils';\nimport { ResourcesConfigOperationsDtosBuilderUtils } from './utils/resources-config-operations.dtos-builder.utils';\nimport { ResourcesSummaryUtils } from './utils/resources-summary.utils';\nimport { collectTemplatableFileFieldPaths, stripTemplatableFileFieldsRecursively } from './utils/templatable-file-fields.shared.utils';\nimport { selectByPersistenceAdapter, type PersistenceAdapterCases } from './utils/persistence-adapter-discrimination.shared.utils';\nimport {\n isServiceResolvableDefaultOperation,\n SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES,\n URL_BEARING_OPERATION_VARIANT_TYPES,\n} from './utils/resource-operation-type-guards.utils';\n\n// --------------------------------\n// Error Helpers\n// --------------------------------\n\n/**\n * Creates a configuration error with ErrorType.CONFIGURATION\n * Used for resource configuration validation errors at build time\n */\n/**\n * Reject an `.impersonalizeWith()` treatment declared BELOW the top level of a retention-governed\n * resource's schema (gate G-FILE / scrub-coverage).\n *\n * The impersonalize writer builds its `$set` from the TOP-LEVEL shape only, and file links are stored\n * under a dotted canonical path (`billingContact.signedMandate`). A nested treatment therefore never\n * reaches the scrub patch and never matches a linked file's `linkedFieldName`: the row flips to\n * RETAINED while the nested personal field — and any file beneath it — survive fully intact, with an\n * audit event asserting the record was impersonalized.\n *\n * Recursive scrubbing (dotted-path patches + the matching file-path recursion) is deliberately out of\n * v1 scope, so this fails at CONFIG BUILD instead of silently under-scrubbing at erasure time. Walks\n * nested ZodObjects (through optional/nullable/default/array wrappers) and every discriminated-union\n * option, mirroring how the runtime resolves field paths.\n */\nfunction assertNoNestedImpersonalizeTreatment(\n schema: z.ZodTypeAny,\n resourceIdentifier: string,\n): void {\n const visited = new Set<unknown>();\n\n const walk = (candidate: z.ZodTypeAny | undefined, path: string, isTopLevel: boolean): void => {\n if (!candidate || visited.has(candidate)) return;\n visited.add(candidate);\n\n if (!isTopLevel && getImpersonalizeTreatment(candidate) !== undefined) {\n throw createConfigurationError(\n `[${resourceIdentifier}] field '${path}' declares an impersonalize treatment, but it is NESTED. ` +\n `The scrub writes a top-level $set only, so a nested treatment would be silently ignored — the row ` +\n `would flip to RETAINED with '${path}' (and any file linked under it) fully intact. Move the field to ` +\n `the top level, or scrub the whole containing field instead (REMOVE on the parent object).`\n );\n }\n\n const shape = getZodObjectShape(unwrapSchema(candidate) ?? candidate);\n for (const [childName, childSchema] of Object.entries(shape ?? {})) {\n walk(childSchema as z.ZodTypeAny, path ? `${path}.${childName}` : childName, false);\n }\n };\n\n // Top-level fields are legitimately treatable; only their DESCENDANTS are the problem.\n const topLevelShape = getZodObjectShape(schema);\n for (const [fieldName, fieldSchema] of Object.entries(topLevelShape ?? {})) {\n const unwrapped = unwrapSchema(fieldSchema as z.ZodTypeAny) ?? (fieldSchema as z.ZodTypeAny);\n const nestedShape = getZodObjectShape(unwrapped);\n for (const [childName, childSchema] of Object.entries(nestedShape ?? {})) {\n walk(childSchema as z.ZodTypeAny, `${fieldName}.${childName}`, false);\n }\n }\n}\n\nfunction createConfigurationError(message: string): Error {\n const error = new Error(message);\n (error as any).type = ErrorType.CONFIGURATION;\n return error;\n}\n\n/**\n * Creates a validation error with ErrorType.VALIDATION\n * Used for runtime data validation errors\n */\nfunction createValidationError(message: string): Error {\n const error = new Error(message);\n (error as any).type = ErrorType.VALIDATION;\n return error;\n}\n\n/**\n * Reads the shared authority rather than re-listing the members: the URL-bearing\n * set is consumed by the route-mount gate, the URL/DTO resolver and this factory,\n * and a variant type added to one copy but not another silently changes which\n * operations get routes.\n */\nfunction isUrlisableOperationVariantType(variantType: ResourceOperationVariantType): boolean {\n return URL_BEARING_OPERATION_VARIANT_TYPES.includes(variantType);\n}\n\n/**\n * The operations a `retentionPolicy` resource must expose to the SERVICE dispatch\n * layer, with the retention primitive that needs each one.\n *\n * Every entry is consumed by BOTH halves of the retention operation contract — the\n * presence check (is it declared in `coreOperations`?) and the resolvability check\n * (does it have a default variant `getServiceOperationPathDefault` can serve?) — so\n * adding a fourth primitive here extends both at once. Listing the ops twice is how\n * a primitive gets a presence guard and no resolvability guard.\n */\nconst RETENTION_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS: readonly {\n operation: CoreResourceOperation;\n primitive: string;\n why: string;\n}[] = [\n {\n operation: CoreResourceOperation.UPDATE_MANY,\n primitive: 'updateManyAsSystem',\n why: 'the impersonalize writer scrubs rows in place via updateManyAsSystem',\n },\n {\n operation: CoreResourceOperation.READ,\n primitive: 'readRetainedAsSystem',\n why: 'the see-through read primitive readRetainedAsSystem surfaces a single retained record via READ',\n },\n {\n operation: CoreResourceOperation.LIST,\n primitive: 'listRetainedAsSystem',\n why: 'the see-through read primitive listRetainedAsSystem surfaces retained records via LIST',\n },\n];\n\n/**\n * The operations an `isAnonymizable` resource must expose to the SERVICE dispatch\n * layer, with the `AnonymousSessionBackendService` primitive that needs each one.\n *\n * Sibling of {@link RETENTION_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS} and consumed by\n * the same TWO halves — presence (is it declared in `coreOperations`?) and\n * resolvability (does it have a default variant `getServiceOperationPathDefault`\n * can serve?). A separate constant rather than a shared one, because the two\n * capabilities demand different operations for different reasons and merging them\n * would make each entry's `why` unreadable.\n *\n * **Each entry is a DISJUNCTION, and that is the whole design decision.** Retention\n * needs three specific operations, so its constant is a flat list of single ops.\n * The anonymous-session cleanup needs to DELETE a known id set, and\n * `deleteOwnedRecords` deliberately serves that with `DELETE_MANY` when the\n * resource publishes one and per-row `DELETE` otherwise — so demanding\n * `DELETE_MANY` would force every anonymizable resource to publish a bulk-delete\n * surface it may not want (`draftNotes`, the only such resource today, publishes\n * `DELETE` alone), while demanding `DELETE` would refuse a resource that\n * legitimately publishes only the bulk form. The honest requirement is \"at least\n * one of these resolves\", which is exactly what the runtime probes.\n *\n * Measured 2026-09-09: before this guard existed, `deleteOwnedRecords` resolved\n * `DELETE_MANY` unconditionally, so for `draftNotes` the cleanup batch's phase 1\n * threw on every run — the per-session catch counted an error and the\n * `ANONYMOUS_USERS` anchor row was never removed. The runtime is now correct; this\n * constant is what refuses the configuration at boot instead of discovering it at\n * the first sweep.\n */\nconst ANONYMIZABLE_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS: readonly {\n /** Alternatives — the requirement is satisfied when AT LEAST ONE of these is declared / resolvable. */\n operations: readonly CoreResourceOperation[];\n primitive: string;\n why: string;\n}[] = [\n {\n operations: [CoreResourceOperation.LIST],\n primitive: 'listAnonymousRecords',\n why: 'the transposition and cleanup lookups list a session\\'s rows via LIST',\n },\n {\n operations: [CoreResourceOperation.UPDATE_MANY],\n primitive: 'reassignOwnership (updateManyAsSystem)',\n why: 'the anon→user transposition rewrites { userId, anonymousUserId } via updateManyAsSystem',\n },\n {\n operations: [CoreResourceOperation.DELETE_MANY, CoreResourceOperation.DELETE],\n primitive: 'deleteOwnedRecords',\n why: 'the expired-session sweep, the DISCARD transposition arm and the REPLACE pre-delete all remove '\n + 'a known id set, preferring DELETE_MANY and falling back to per-row DELETE',\n },\n];\n\n/** Human-readable \"A or B\" rendering of one requirement group's alternatives. */\nfunction describeOperationAlternatives(operations: readonly CoreResourceOperation[]): string {\n return operations.length === 1 ? String(operations[0]) : operations.join(' or ');\n}\n\nfunction assertOperationPathKeySegment(value: string, label: string, operation: string): void {\n if (value.includes(' | ')) {\n throw createConfigurationError(\n `Operation '${operation}' cannot use ${label} '${value}' because operation path keys reserve the delimiter ' | '`,\n );\n }\n}\n\nfunction createGeneratedRelationshipBulkOperations(\n operations: any[],\n relevantRelationships: ResourceRelationship[],\n resourceIdentifier: ResourceType,\n allResourceFieldIdentifiers: Partial<Record<ResourceType, string>> | Record<string, string>\n): any[] {\n const baseBulkUpdateOperations = operations.filter((operation) =>\n isUrlisableOperationVariantType(operation.variantType)\n && operation.operationIdentifier === CoreResourceOperation.UPDATE\n && 'isBulkOperation' in operation\n && operation.isBulkOperation === true\n );\n\n if (baseBulkUpdateOperations.length > 1) {\n throw createConfigurationError(\n `[${resourceIdentifier}] generated bulk relationship operations require exactly one API bulk UPDATE base operation, but found ${baseBulkUpdateOperations.length}`\n );\n }\n\n const [baseBulkUpdateOperation] = baseBulkUpdateOperations;\n\n if (!baseBulkUpdateOperation) {\n return [];\n }\n\n const generatedOperations: any[] = [];\n const knownOperationIdentifiers = new Set(\n operations.map((operation) => String(operation.operationIdentifier))\n );\n\n for (const relationship of relevantRelationships) {\n const relationshipField = Resources_SharedUtils.resolveRelationshipObjectIdentityForResource(\n relationship,\n resourceIdentifier,\n allResourceFieldIdentifiers\n ).objectFieldName;\n const allowedActions = Resources_SharedUtils.resolveAllowedBulkRelationshipActionsForResource(\n relationship,\n resourceIdentifier\n );\n\n for (const action of allowedActions) {\n const operationIdentifier = Resources_SharedUtils.buildRelationshipBulkOperationIdentifier(\n action,\n relationshipField\n );\n\n if (knownOperationIdentifiers.has(operationIdentifier)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] generated bulk relationship operation \"${operationIdentifier}\" collides with an existing operation identifier`\n );\n }\n\n knownOperationIdentifiers.add(operationIdentifier);\n\n const requestDto = (() => {\n switch (action) {\n case ResourceRelationshipBulkAction.SET:\n return ResourceRelationshipBulkSetOperationRequestSchema;\n case ResourceRelationshipBulkAction.CLEAR:\n return ResourceRelationshipBulkClearOperationRequestSchema;\n case ResourceRelationshipBulkAction.CREATE:\n return ResourceRelationshipBulkCreateOperationRequestSchema;\n case ResourceRelationshipBulkAction.LINK:\n return ResourceRelationshipBulkLinkOperationRequestSchema;\n case ResourceRelationshipBulkAction.UNLINK:\n return ResourceRelationshipBulkUnlinkOperationRequestSchema;\n case ResourceRelationshipBulkAction.REPLACE:\n return ResourceRelationshipBulkReplaceOperationRequestSchema;\n }\n })();\n\n generatedOperations.push({\n ...baseBulkUpdateOperation,\n operationIdentifier,\n isDefault: false,\n isOperationDefault: false,\n isBulkOperation: true,\n resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n requestDto,\n // Generated bulk-relationship ops own an explicit request contract (the\n // bulk action schema above) — preserve it verbatim, never rebuild.\n hasCustomRequestDto: true,\n responseDto: ResourceRelationshipBulkActionResultSchema,\n hasCustomResponseDto: true,\n basicPrefixOperation: undefined,\n notificationBadgeOperations: [],\n userNotifications: [],\n m2mNotifications: [],\n tokenGeneration: undefined,\n tokenRevocation: undefined,\n });\n }\n }\n\n return generatedOperations;\n}\n\nexport function reconcileGeneratedRelationshipBulkOperations(\n resourceConfigurations: Record<string, AnyResourceConfiguration>,\n allResourceRelationships: ResourceRelationship[],\n allResourceFieldIdentifiers: Partial<Record<ResourceType, string>> | Record<string, string>\n): void {\n for (const [resourceType, resourceConfiguration] of Object.entries(resourceConfigurations)) {\n if (!Array.isArray(resourceConfiguration.operations)) {\n continue;\n }\n\n const currentResourceType = resourceType as ResourceType;\n const nonGeneratedOperations = resourceConfiguration.operations.filter(\n (operation) => !Resources_SharedUtils.parseRelationshipBulkOperationIdentifier(String(operation.operationIdentifier))\n );\n const relevantRelationships = allResourceRelationships.filter(\n (relationship) =>\n relationship.resourceType1 === currentResourceType\n || relationship.resourceType2 === currentResourceType\n );\n\n resourceConfiguration.operations = [\n ...nonGeneratedOperations,\n ...createGeneratedRelationshipBulkOperations(\n nonGeneratedOperations,\n relevantRelationships,\n currentResourceType,\n allResourceFieldIdentifiers\n ),\n ];\n }\n}\n\n/**\n * Derive the CSV/JSON export companion of every LIST/SEARCH operation that declared\n * `collectionExport`.\n *\n * ## Why derived rather than authored\n *\n * The export must be exactly as reachable as the listing it exports — never more. Copying the source\n * operation wholesale and overriding only what must differ makes that structural: an author cannot\n * give the export wider `roles`, a different parent-scope path, or a laxer variant, because they\n * never write it. It is the same construction `createGeneratedFileRegenerateOperations` uses one\n * function above.\n *\n * ## What is deliberately CLEARED rather than inherited\n *\n * `mcp` is the one that matters. A LIST curated onto an MCP server is a PAGINATED read tool; its\n * export companion returns the whole result set in a single call, which is a different risk profile.\n * Spreading the source operation would silently turn \"this app declared an export\" into \"this app\n * grew a new agent tool that exfiltrates the table\", so the flag is dropped and an application that\n * genuinely wants an agent-callable export has to say so.\n *\n * The notification/token fields are cleared for the same reason they are on the regenerate\n * companion: they describe effects of the SOURCE operation and firing them again on an export would\n * double-notify.\n */\nfunction createGeneratedCollectionExportOperations(params: {\n operations: any[];\n resourceIdentifier: ResourceType;\n}): any[] {\n const knownOperationIdentifiers = new Set(\n params.operations.map((operation) => String(operation.operationIdentifier)),\n );\n\n const exportOperations: any[] = [];\n\n for (const operation of params.operations) {\n const exportConfig = (operation as { collectionExport?: ResourceCollectionExportConfig }).collectionExport;\n if (!exportConfig) {\n continue;\n }\n\n const sourceOperationIdentifier = String(operation.operationIdentifier);\n\n if (!isUrlisableOperationVariantType(operation.variantType)) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] operation \"${sourceOperationIdentifier}\" declares collectionExport but is not URL-bearing; an export has no route to live on`\n );\n }\n\n // The source's CORE verb decides which service call the export re-runs, and it is the only thing\n // that can: a custom operation carries LIST/SEARCH semantics through `resourceOperationLike`.\n const sourceCoreOperation = (operation.resourceOperationLike ?? operation.operationIdentifier) as CoreResourceOperation;\n if (sourceCoreOperation !== CoreResourceOperation.LIST && sourceCoreOperation !== CoreResourceOperation.SEARCH) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] operation \"${sourceOperationIdentifier}\" declares collectionExport but is neither LIST nor SEARCH (resolved core operation: ${String(sourceCoreOperation)})`\n );\n }\n\n // Empty arrays are a startup error, never a silent \"offer everything\" — the same rule\n // `mcp.servers` follows, so the declaration always reads as \"exactly these\".\n if (!exportConfig.formats || exportConfig.formats.length === 0) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] operation \"${sourceOperationIdentifier}\" declares collectionExport with no formats; declare at least one, or omit collectionExport entirely`\n );\n }\n if (!exportConfig.rowScopes || exportConfig.rowScopes.length === 0) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] operation \"${sourceOperationIdentifier}\" declares collectionExport with no rowScopes; declare at least one, or omit collectionExport entirely`\n );\n }\n if (exportConfig.maximumExportedRows !== undefined && exportConfig.maximumExportedRows <= 0) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] operation \"${sourceOperationIdentifier}\" declares a non-positive collectionExport.maximumExportedRows; omit it for no ceiling`\n );\n }\n\n const operationIdentifier = Resources_SharedUtils.buildGeneratedCollectionExportOperationIdentifier(sourceOperationIdentifier);\n if (knownOperationIdentifiers.has(operationIdentifier)) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] generated collection export operation \"${operationIdentifier}\" collides with an existing operation identifier`\n );\n }\n knownOperationIdentifiers.add(operationIdentifier);\n\n exportOperations.push({\n ...operation,\n operationIdentifier,\n isDefault: false,\n isOperationDefault: false,\n isBulkOperation: false,\n httpVerb: HttpMethod.GET,\n // Keeps the URL builder treating it as collection-level, and gives a SEARCH export the\n // `search` segment its source already has — so the two exports of one resource cannot collide.\n resourceOperationLike: sourceCoreOperation,\n generatedOperation: {\n kind: ResourceGeneratedOperationKind.GENERATED_COLLECTION_EXPORT,\n sourceOperationIdentifier,\n sourceCoreOperation,\n export: exportConfig,\n },\n // The export takes the SOURCE's query contract (filters, sort, q, pagination) verbatim plus its\n // own two selectors, so \"export what I am looking at\" is expressible without a second grammar.\n responseDto: ResourceCollectionExportResponseSchema,\n internalDto: ResourceCollectionExportResponseSchema,\n hasCustomResponseDto: true,\n // Cleared, not inherited — see this function's docstring.\n mcp: undefined,\n collectionExport: undefined,\n basicPrefixOperation: undefined,\n notificationBadgeOperations: [],\n userNotifications: [],\n m2mNotifications: [],\n tokenGeneration: undefined,\n tokenRevocation: undefined,\n });\n }\n\n return exportOperations;\n}\n\nfunction createGeneratedFileRegenerateOperations(params: {\n operations: any[];\n resourceIdentifier: ResourceType;\n resourceFieldIdentifier: string;\n mainSchema: z.ZodTypeAny;\n generatedFileDiscoverySchema?: z.ZodTypeAny;\n persistenceAdapter?: unknown;\n}): any[] {\n const generatedFileDiscoverySchema = params.generatedFileDiscoverySchema ?? params.mainSchema;\n const collectedFields = collectTemplatableFileFieldPaths(generatedFileDiscoverySchema);\n const arrayContainedFields = collectedFields.filter((field) => field.isInsideArray);\n if (arrayContainedFields.length > 0) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] generated PDF file fields inside arrays or dynamic containers are not supported in v1: ${arrayContainedFields.map((field) => field.fieldName).join(', ')}`\n );\n }\n\n const generatedFields = collectedFields.filter(\n (field) => !field.isInsideArray,\n );\n if (generatedFields.length === 0) {\n return [];\n }\n /**\n * A generated document is MATERIALIZED: rendering it writes a FILES metadata row that must\n * commit in the SAME native transaction as the row that owns it, or a failure between the two\n * leaves either a dangling document reference or an orphaned blob. So the only question this\n * guard can honestly ask of a DECLARATION is whether the declared adapter is one that HAS a\n * transactional local store at all.\n *\n * ## What changed, and why the old shape was wrong rather than merely conservative\n *\n * This refused every adapter except MongoDB, on the grounds that file metadata was pinned to\n * MongoDB, so a generated PDF on a PostgreSQL resource would have crossed adapters. That reason\n * is gone: FILES was un-pinned and now FOLLOWS the application's default adapter\n * (`files.shared.resources-config.schemas.ts:43-67`), precisely so a resource and its file\n * metadata share one native transaction. A PostgreSQL application whose FILES is therefore also\n * PostgreSQL was being refused at authoring time for a boundary that no longer exists.\n *\n * The ASYMMETRY was the tell, and it is the reason this could not be left alone: `undefined` —\n * \"follow the application default\" — was and is admitted, so the identical resource in the\n * identical PostgreSQL application was already authorable by SAYING LESS. A guard whose answer\n * depends on whether a redundant declaration was written is testing the declaration, not the\n * capability.\n *\n * ## What still refuses, and why that half is load-bearing\n *\n * `INTROSPECTION` rows are recomputed per read — there is no store and no transaction. `HTTP_API`\n * rows live in someone else's system and are read-only by construction. Neither can own a\n * locally-materialized document row, and unlike the PostgreSQL case that is knowable from the\n * declaration alone, so refusing at authoring time is strictly better than discovering it on the\n * first write. `getDatabaseServiceForAdapter` says the same thing at runtime, for the same two\n * adapters, in the same words.\n *\n * ## Shape\n *\n * Expressed as an exhaustive `PersistenceAdapterCases` map rather than a comparison, so a fifth\n * backing kind is a COMPILE error here instead of silently inheriting whichever arm an `else`\n * happened to mean — the failure mode `selectByPersistenceAdapter` exists to remove, and the one\n * the previous `!== MONGODB` shape genuinely had in the other direction (it would have refused a\n * future stored adapter without anyone deciding to).\n *\n * `isPersistenceAdapter` runs FIRST so an erased or unknown declaration keeps refusing through\n * `createConfigurationError` with the resource and the field list named, rather than through the\n * selector's plain `Error`. This factory is a shared-tier authoring surface: its refusals are\n * read by an application author, and the field list is the actionable half.\n *\n * ## What this guard deliberately does NOT decide\n *\n * It cannot see the application's default adapter, so it cannot tell whether THIS resource and\n * FILES resolve to the same store — a resource declaring `POSTGRESQL` inside a MongoDB-default\n * application is a real cross-adapter boundary and must still be refused. That refusal is made\n * where the resolved adapters are actually known, at\n * `services-registry-handler.backend.service.ts` →\n * `assertGeneratedFileMaterializationCommitsWithRow`, which asks the persistence unit of work\n * whether `{this resource, FILES-as-ATOMIC}` can commit atomically and throws\n * `MIXED_PERSISTENCE_ADAPTERS` when it cannot. It gates all three materialization entry points\n * (create, createMany, regenerate) and, unlike this one, also covers the undeclared case this\n * guard has always waved through — which is why relaxing here narrows nothing.\n */\n const GENERATED_DOCUMENT_MATERIALIZATION_SUPPORT: PersistenceAdapterCases<boolean> = {\n [PersistenceAdapter.MONGODB]: true,\n [PersistenceAdapter.POSTGRESQL]: true,\n [PersistenceAdapter.INTROSPECTION]: false,\n [PersistenceAdapter.HTTP_API]: false,\n };\n if (params.persistenceAdapter !== undefined) {\n const declaredAdapter = params.persistenceAdapter;\n const materializationIsSupported = isPersistenceAdapter(declaredAdapter)\n && selectByPersistenceAdapter(declaredAdapter, GENERATED_DOCUMENT_MATERIALIZATION_SUPPORT);\n if (!materializationIsSupported) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] generated PDF file fields require a persistence adapter with a transactional local store, `\n + `so that the generated file's metadata row commits with the row that owns it `\n + `(declared adapter: '${String(declaredAdapter)}'; supported: `\n + `'${PersistenceAdapter.MONGODB}', '${PersistenceAdapter.POSTGRESQL}', or no declaration to follow the application default): `\n + `${generatedFields.map((field) => field.fieldName).join(', ')}`\n );\n }\n }\n\n const baseUpdateOperation = params.operations.find((operation) =>\n isUrlisableOperationVariantType(operation.variantType)\n && operation.operationIdentifier === CoreResourceOperation.UPDATE\n && 'isBulkOperation' in operation\n && operation.isBulkOperation !== true\n && operation.isOperationDefault === true\n );\n if (!baseUpdateOperation) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] generated file regenerate operations require a default non-bulk URL-bearing UPDATE operation`\n );\n }\n\n const knownOperationIdentifiers = new Set(\n params.operations.map((operation) => String(operation.operationIdentifier))\n );\n const responseDto = z.object({\n file: SingleFileValueSchema,\n resource: generatedFileDiscoverySchema,\n });\n\n return generatedFields.map(({ fieldName }) => {\n const operationIdentifier = Resources_SharedUtils.buildGeneratedFileRegenerateOperationIdentifier(fieldName);\n if (knownOperationIdentifiers.has(operationIdentifier)) {\n throw createConfigurationError(\n `[${params.resourceIdentifier}] generated file regenerate operation \"${operationIdentifier}\" collides with an existing operation identifier`\n );\n }\n knownOperationIdentifiers.add(operationIdentifier);\n\n return {\n ...baseUpdateOperation,\n operationIdentifier,\n isDefault: false,\n isOperationDefault: false,\n isBulkOperation: false,\n httpVerb: HttpMethod.POST,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n generatedOperation: {\n kind: ResourceGeneratedOperationKind.GENERATED_FILE_REGENERATE,\n fieldName,\n },\n requestDto: z.object({}),\n // Generated file-regenerate ops own their request contract: an intentionally\n // empty body (regeneration is UPDATE-like but takes no input). Preserve it,\n // do not rebuild from mainSchema decorators.\n hasCustomRequestDto: true,\n responseDto,\n internalDto: responseDto,\n hasCustomResponseDto: true,\n basicPrefixOperation: undefined,\n notificationBadgeOperations: [],\n userNotifications: [],\n m2mNotifications: [],\n tokenGeneration: undefined,\n tokenRevocation: undefined,\n };\n });\n}\n\n// --------------------------------\n// Token Config Validation\n// --------------------------------\n\nconst BULK_MUTATION_CORE_OPERATIONS: ReadonlySet<CoreResourceOperation> = new Set([\n CoreResourceOperation.CREATE_MANY,\n CoreResourceOperation.UPDATE_MANY,\n CoreResourceOperation.DELETE_MANY,\n]);\nconst TOKEN_STATE_EFFECT_UNSUPPORTED_CORE_OPERATIONS: ReadonlySet<CoreResourceOperation> = new Set([\n ...BULK_MUTATION_CORE_OPERATIONS,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.COUNT,\n]);\n\nfunction isCoreBulkMutationOperation(\n operationIdentifier: unknown,\n): boolean {\n return BULK_MUTATION_CORE_OPERATIONS.has(\n operationIdentifier as CoreResourceOperation,\n );\n}\n\nfunction isTokenStateEffectUnsupportedOperation(\n operationIdentifier: unknown,\n): boolean {\n return TOKEN_STATE_EFFECT_UNSUPPORTED_CORE_OPERATIONS.has(\n operationIdentifier as CoreResourceOperation,\n );\n}\n\n/**\n * Validates tokenGeneration configuration at build time.\n * Catches common mistakes before the app starts.\n */\nfunction validateTokenGenerationConfig(\n config: TokenGenerationConfig,\n resourceIdentifier: string,\n operationIdentifier: string,\n): void {\n const prefix = `[${resourceIdentifier}.${operationIdentifier}] tokenGeneration`;\n\n // BOUNDED_REUSE requires maxUses\n if (config.consumptionMode === ConsumableToken_ConsumptionMode.BOUNDED_REUSE) {\n if (config.maxUses == null || config.maxUses < 1) {\n throw createConfigurationError(\n `${prefix}: consumptionMode is BOUNDED_REUSE but maxUses is ${config.maxUses ?? 'missing'}. ` +\n `BOUNDED_REUSE tokens must specify maxUses >= 1.`,\n );\n }\n }\n\n // maxUses should NOT be set for non-BOUNDED_REUSE modes (likely a mistake)\n if (config.consumptionMode !== ConsumableToken_ConsumptionMode.BOUNDED_REUSE && config.maxUses != null) {\n throw createConfigurationError(\n `${prefix}: maxUses is set (${config.maxUses}) but consumptionMode is ${config.consumptionMode}. ` +\n `maxUses is only valid for BOUNDED_REUSE tokens. Remove maxUses or change consumptionMode.`,\n );\n }\n\n // tokenType is required\n if (!config.tokenType) {\n throw createConfigurationError(`${prefix}: tokenType is required.`);\n }\n\n // expiresIn is required\n if (config.expiresIn == null) {\n throw createConfigurationError(`${prefix}: expiresIn is required (static value or derived function).`);\n }\n\n // If expiresIn is static, validate shape (minutes, hours, days only; value >= 1)\n if (typeof config.expiresIn !== 'function') {\n const result = ExpiresInDurationSchema.safeParse(config.expiresIn);\n if (!result.success) {\n const msg = result.error.issues.map((i) => i.message).join('; ');\n throw createConfigurationError(`${prefix}: expiresIn validation failed: ${msg}`);\n }\n }\n\n // W7.3b: createsOneOffSession requires consumeAt\n if (config.createsOneOffSession && !config.consumeAt) {\n throw createConfigurationError(\n `${prefix}: createsOneOffSession is true but consumeAt is missing. ` +\n `Specify 'EXCHANGE' or 'TARGET_OPERATION'.`,\n );\n }\n\n // W7.3b: consumeAt without createsOneOffSession is a mistake\n if (config.consumeAt && !config.createsOneOffSession) {\n throw createConfigurationError(\n `${prefix}: consumeAt is set ('${config.consumeAt}') but createsOneOffSession is not true. ` +\n `consumeAt only applies to one-off session tokens.`,\n );\n }\n}\n\n/**\n * Validates tokenRevocation configuration at build time.\n */\nfunction validateTokenRevocationConfig(\n config: TokenRevocationConfig,\n resourceIdentifier: string,\n operationIdentifier: string,\n): void {\n const prefix = `[${resourceIdentifier}.${operationIdentifier}] tokenRevocation`;\n\n if (!config.tokenTypes || config.tokenTypes.length === 0) {\n throw createConfigurationError(`${prefix}: tokenTypes must be a non-empty array of token types to revoke.`);\n }\n}\n\n// --------------------------------\n// Required Features Normalization\n// --------------------------------\n\n/**\n * Normalizes requiredFeatures input to the full form.\n * - undefined → undefined (no features required)\n * - string[] → { features: [...], mode: 'OR' } (shorthand)\n * - full config → passed through as-is\n */\nfunction normalizeRequiredFeatures(input: RequiredFeaturesConfig | undefined): RequiredFeaturesNormalized | undefined {\n if (input === undefined) return undefined;\n if (Array.isArray(input)) {\n // Shorthand: string[] → { features: [...], mode: 'OR' }\n return { features: input, mode: 'OR' };\n }\n return input;\n}\n\n// --------------------------------\n// DTO Auto-Derivation Utilities\n// --------------------------------\n\n/**\n * @wildo_source:part:start saas.models.resource-config.system-managed-fields facet:layer:shared facet:audience:app-developer\n *\n * The field names the framework owns. They are removed from every generated CREATE and UPDATE\n * request contract, for every resource, whatever your schema declares and whatever a caller sends.\n *\n * Declaring one of these in a resource schema is fine and often necessary — the framework maintains\n * the value. What you cannot do is accept it from a client, default it in a form, or require it on a\n * create: the field is stripped before validation runs, so a form that collects it submits a value\n * that is discarded, and a schema that requires it rejects every request.\n *\n * | field | who writes it |\n * |---|---|\n * | `_id` | the persistence layer (or your own `.isPrimaryKey()` field, stored beneath it) |\n * | `createdAt` / `updatedAt` / `deletedAt` | the repository, on write |\n * | `createdByUserId` | the repository, stamped from the execution context on CREATE, immutable afterwards |\n * | `_version_db_doc` | the framework's optimistic-concurrency marker |\n *\n * The failure this prevents is quiet and was paid for once: a create form validating against a\n * reserved field that no form collects fails every submit with `expected string, received undefined`,\n * and the schema looks correct while it does. So the exclusion is unconditional and does not depend\n * on the resource author remembering `.excludeFromCreate()`.\n *\n * ⚠️ A NARROWER set — `_id`, `createdAt`, `updatedAt`, `deletedAt`, `_version_db_doc` — is\n * additionally *mandatory-discard*: even a trusted in-process system write cannot re-attach those\n * through `preserveServerInjectedFields`. `createdByUserId` is deliberately not in that set, because\n * an engine flow creating a row on somebody's behalf legitimately needs to stamp it.\n */\nconst SYSTEM_MANAGED_FIELDS = ['_id', 'createdAt', 'updatedAt', 'deletedAt', 'createdByUserId', '_version_db_doc'] as const;\n/** @wildo_source:part:end saas.models.resource-config.system-managed-fields */\n\n// PRIMARY_SCOPE_FIELD_IDENTIFIERS and getPrimaryScopeFieldIdentifier imported from resources.shared.schemas\n\n/**\n * Build a CREATE request DTO from the main schema using decorators.\n *\n * Excludes:\n * - System-managed fields (_id, createdAt, updatedAt, etc.)\n * - Virtual fields (computed, not stored)\n * - Fields with excludeFromCreate decorator\n *\n * NOTE: Backend-only fields (isBackendOnly) are NOT excluded from CREATE DTOs.\n * The isBackendOnly decorator controls RESPONSE filtering (what is returned to clients),\n * not REQUEST filtering (what can be set during creation). Backend operations need to\n * set fields like passwordHash, apiKey, etc. directly during resource creation.\n *\n * @param mainSchema - The main resource schema\n * @param customExclusions - Additional fields to exclude\n * @returns A new schema with only creatable fields\n */\nexport function buildCreateRequestDto<T extends z.ZodTypeAny>(\n mainSchema: T,\n customExclusions?: string[]\n): z.ZodTypeAny {\n try {\n const shape = getZodObjectShape(mainSchema);\n const createShape: Record<string, z.ZodTypeAny> = {};\n\n for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n const typedSchema = fieldSchema as z.ZodTypeAny;\n\n // Exclude system-managed fields\n if ((SYSTEM_MANAGED_FIELDS as readonly string[]).includes(fieldName)) continue;\n\n // Exclude primary scope field identifiers (auto-populated from context)\n if ((PRIMARY_SCOPE_FIELD_IDENTIFIERS as readonly string[]).includes(fieldName)) continue;\n\n // Exclude virtual fields (computed, not stored)\n if (isVirtualField(typedSchema)) continue;\n\n // Exclude explicitly marked fields\n if (isExcludedFromCreate(typedSchema)) continue;\n\n // Exclude generated file fields; clients cannot upload or author values\n // that are materialized by framework-owned operations.\n if (isTemplatableFileField(typedSchema)) continue;\n\n // NOTE: Backend-only fields are NOT excluded here.\n // isBackendOnly controls response filtering, not request filtering.\n // Backend operations need to set fields like passwordHash directly.\n\n // Exclude non-discriminator literals (fixed values auto-populated by backend)\n // Discriminator literals are kept for variant selection\n const unwrapped = unwrapSchema(typedSchema);\n if (getZodType(unwrapped) === 'literal' && !isDiscriminatorField(typedSchema)) continue;\n\n // Exclude custom exclusions\n if (customExclusions?.includes(fieldName)) continue;\n\n createShape[fieldName] = stripTemplatableFileFieldsRecursively(fieldSchema as z.ZodTypeAny);\n }\n\n return stripTemplatableFileFieldsRecursively(z.object(createShape));\n } catch {\n // If schema is not an object, return as-is\n return mainSchema;\n }\n}\n\n\n\n\n/**\n * Build an UPDATE request DTO from the main schema using decorators.\n *\n * Excludes:\n * - System-managed fields (_id, createdAt, updatedAt, etc.)\n * - Virtual fields (computed, not stored)\n * - Fields with excludeFromUpdate decorator\n *\n * NOTE: Backend-only fields (isBackendOnly) are NOT excluded from UPDATE DTOs.\n * The isBackendOnly decorator controls RESPONSE filtering (what is returned to clients),\n * not REQUEST filtering (what can be set during updates). Backend operations may need\n * to update fields like passwordHash, apiKey, etc. directly.\n *\n * All remaining fields are made optional for PATCH-style updates.\n *\n * @param mainSchema - The main resource schema\n * @param customExclusions - Additional fields to exclude\n * @returns A new partial schema with only updatable fields\n */\nfunction buildUpdateRequestDto<T extends z.ZodTypeAny>(\n mainSchema: T,\n customExclusions?: string[]\n): z.ZodTypeAny {\n try {\n const shape = getZodObjectShape(mainSchema);\n const updateShape: Record<string, z.ZodTypeAny> = {};\n\n for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n const typedSchema = fieldSchema as z.ZodTypeAny;\n\n // Exclude system-managed fields\n if ((SYSTEM_MANAGED_FIELDS as readonly string[]).includes(fieldName)) continue;\n\n // Exclude primary scope field identifiers (immutable, context-derived)\n if ((PRIMARY_SCOPE_FIELD_IDENTIFIERS as readonly string[]).includes(fieldName)) continue;\n\n // Exclude virtual fields (computed, not stored)\n if (isVirtualField(typedSchema)) continue;\n\n // Exclude explicitly marked fields\n if (isExcludedFromUpdate(typedSchema)) continue;\n\n // Exclude generated file fields; explicit regenerate operations own\n // refreshing these values instead of generic UPDATE payloads.\n if (isTemplatableFileField(typedSchema)) continue;\n\n // NOTE: Backend-only fields are NOT excluded here.\n // isBackendOnly controls response filtering, not request filtering.\n // Backend operations may need to update fields like passwordHash.\n\n // Exclude ALL literal fields (immutable after creation)\n const unwrapped = unwrapSchema(typedSchema);\n if (getZodType(unwrapped) === 'literal') continue;\n\n // Exclude custom exclusions\n if (customExclusions?.includes(fieldName)) continue;\n\n // Make field optional for PATCH-style update, peeling any `.default()` so\n // an omitted field is never re-materialized to its default and written\n // back over the stored value (see `toPatchOptionalField`).\n updateShape[fieldName] = toPatchOptionalField(\n stripTemplatableFileFieldsRecursively(fieldSchema as z.ZodTypeAny),\n );\n }\n\n return stripTemplatableFileFieldsRecursively(z.object(updateShape));\n } catch {\n // If schema is not an object, return as-is\n return mainSchema;\n }\n}\n\n/**\n * Derives the appropriate request DTO based on operation type.\n *\n * - CREATE: Uses buildCreateRequestDto (excludes excludeFromCreate fields)\n * - UPDATE: Uses buildUpdateRequestDto (excludes excludeFromUpdate fields, all partial)\n * - READ/DELETE and custom operations without an explicit DTO: empty object\n *\n * This is an early factory placeholder. The final DTO pass in\n * ResourcesConfigOperationsDtosBuilderUtils applies inherited schemas, the\n * shared no-body operation policy, and SEARCH query schemas derived from\n * collection-view metadata.\n *\n * @param operation - The operation identifier\n * @param mainSchema - The main resource schema\n * @param providedDto - Explicitly provided DTO (takes precedence)\n * @returns The appropriate request DTO schema\n */\nexport function deriveRequestDto<T extends z.ZodTypeAny>(\n operation: string,\n mainSchema: T,\n providedDto?: z.ZodTypeAny\n): z.ZodTypeAny {\n // If explicit DTO is provided, use it (for custom operations)\n if (providedDto !== undefined) {\n return stripTemplatableFileFieldsRecursively(providedDto);\n }\n\n // Auto-derive based on operation type\n switch (operation) {\n case CoreResourceOperation.CREATE:\n return buildCreateRequestDto(mainSchema);\n case CoreResourceOperation.UPDATE:\n return buildUpdateRequestDto(mainSchema);\n case CoreResourceOperation.READ:\n case CoreResourceOperation.DELETE:\n // READ and DELETE don't need request bodies (just URL params)\n return z.object({});\n default:\n // For custom operations without explicit DTO, return empty object\n // (custom operations should provide their own requestDto)\n return z.object({});\n }\n}\n\n// --------------------------------\n// Decorator Combination Validation\n// --------------------------------\n\n/**\n * Validates that decorated fields don't have invalid decorator combinations.\n *\n * Invalid combinations:\n * - isSummaryField + isBackendOnly: Backend-only fields can't be in summaries\n * - isDiscriminator + excludeFromCreate: Discriminator is required for create operations\n *\n * @param mainSchema - The main schema to validate\n * @param resourceIdentifier - Resource name for error messages\n * @throws Error if invalid decorator combinations are found\n */\nfunction validateDecoratorCombinations(\n mainSchema: z.ZodTypeAny,\n resourceIdentifier: string\n): void {\n const issues: string[] = [];\n\n try {\n const shape = getZodObjectShape(mainSchema);\n\n for (const [fieldName, fieldSchema] of Object.entries(shape)) {\n const typedSchema = fieldSchema as z.ZodTypeAny;\n\n // Check: isSummaryField + isBackendOnly is invalid\n if (isSummaryField(typedSchema) && isBackendOnlyField(typedSchema)) {\n issues.push(\n `Field '${fieldName}' has both isSummaryField and isBackendOnly decorators. ` +\n `Backend-only fields cannot be included in summary responses.`\n );\n }\n\n // Check: isDiscriminator + excludeFromCreate is invalid\n if (isDiscriminatorField(typedSchema) && isExcludedFromCreate(typedSchema)) {\n issues.push(\n `Field '${fieldName}' has both isDiscriminator and excludeFromCreate decorators. ` +\n `Discriminator fields must be present in create requests to determine the variant type.`\n );\n }\n\n // Check: isDiscriminator + excludeFromUpdate is a warning (logged but not an error)\n // Discriminators are typically immutable, so this might be intentional\n }\n } catch {\n // Schema may not be an object, skip validation\n return;\n }\n\n if (issues.length > 0) {\n throw createConfigurationError(\n `Resource '${resourceIdentifier}' has invalid decorator combinations:\\n` +\n issues.map(issue => ` - ${issue}`).join('\\n')\n );\n }\n}\n\n// --------------------------------\n// Helper Types\n// --------------------------------\n\n/**\n * User notification definition for ResourceConfiguration builder.\n * Omits 'primaryScope' (auto-derived) and 'identifier' (auto-generated).\n *\n * Note: customNotificationRef is optional but REQUIRED when there are 2+ notifications\n * of the same target type in the same operation.\n *\n * Distributive omit: `UserNotificationDefinition` is a discriminated union (by\n * `channel`); a bare `Omit<Union, K>` collapses to only the COMMON keys and silently\n * drops every channel-specific field (the EMAIL variant's `recipientEmailField`, the\n * FRONT_END_SUCCESS variant's `celebration`/`nextStep`). Distributing over each union\n * member preserves those per-channel fields for config authoring.\n */\ntype DistributiveOmit<T, K extends PropertyKey> = T extends unknown ? Omit<T, K> : never;\ntype UserNotificationDefinitionWithoutPrimaryScopeAndIdentifier = DistributiveOmit<UserNotificationDefinition, 'primaryScope' | 'identifier'>;\ntype M2MNotificationDefinitionWithoutIdentifier = Omit<M2MNotificationDefinition, 'identifier'>;\n\n// --------------------------------\n// Helper Functions\n// --------------------------------\n\n/**\n * Transforms and categorizes resource relationships into parent/child/self buckets.\n *\n * ## Flat Categorization (No Separate Conditional Bucket)\n *\n * ALL relationships — including those with `discriminator` or `condition` — are placed\n * into the same three buckets (parentRelationships, childRelationships, selfRelationships).\n * Conditional relationships carry their filter inline on the relationship object itself,\n * so runtime consumers evaluate conditions when actual parent data is available:\n *\n * - **ResourceContextBackendService**: Checks discriminator/condition in `fetchChildResourcesWithPolicy`\n * against the parentResource BEFORE querying children.\n * - **ServicesRegistryHandler**: Uses `filterRelationshipsByParent()` at 4 points\n * (nested CREATE, READ, UPDATE, lifecycle DELETE) to filter active child relationships.\n * - **ContainerNested** (frontend): Evaluates discriminator/condition against parentData\n * with try-catch safety to prevent React tree crashes.\n *\n * Previously, a separate `inheritanceSchemaRelationships` bucket existed but was never\n * consumed at runtime, making the conditional system non-functional. That bucket has\n * been removed in favor of this flat, inline approach.\n *\n * ## M:N Relationship Decomposition\n *\n * Many-to-many relationships are decomposed into synthetic 1:N relationships:\n * - **Junction table**: Gets two parent relationships (one from each entity side),\n * with OPTIONAL_CONTEXT. These do NOT carry discriminator/condition (the junction\n * table itself doesn't need condition awareness — it's the entity sides that do).\n * - **Entity sides**: Each gets a child relationship to the junction table.\n * These DO carry the original `discriminator` and `condition` from the M:N declaration,\n * ensuring conditional M:N relationships work correctly.\n *\n * Important: this decomposition is an internal compilation step, not a second\n * developer-facing configuration surface. Developers declare one M:N\n * association with `jointResourceType`; the factory derives the synthetic\n * junction-facing edges needed by DTO builders, URL generation, and runtime\n * services.\n *\n * ## Relationship Direction Convention\n *\n * - `resourceType1` = parent, `resourceType2` = child\n * - `foreignKeyField` lives on the child (resourceType2) and points to the parent\n * - Example: USERS → USER_PROFILES with foreignKeyField: 'userId'\n * means userId is a field on USER_PROFILES pointing to USERS\n *\n * @param resourceRelationships - All relationships from the registry\n * @param resourceIdentifier - The resource type being processed\n * @returns Categorized relationships + set of available parent resource types\n */\nfunction transformResourceRelationships(\n resourceRelationships: ResourceRelationship[],\n resourceIdentifier: ResourceType\n): {\n processedResourceRelationships: ResourceConfiguration_ResourceRelationships;\n availableParentResourceTypes: Set<ResourceType>;\n} {\n // Categorize ALL relationships (including those with discriminator) into parent/child/self.\n // Relationships with a discriminator carry their filter inline on the relationship object itself,\n // so runtime consumers (ResourceContext, ContainerNested, services-registry-handler) evaluate\n // the discriminator at read/write time — no separate bucket is needed.\n //\n // Parent relationships are defined as: parent → child (resourceType1 → resourceType2)\n // When processing a resource, we look for relationships where we are the child (resourceType2)\n //\n // The foreignKeyField in these relationships specifies the FK field on the CHILD (resourceType2)\n // that points to the parent. This is the standard pattern for parent-child relationships.\n // Example: USERS → USER_PROFILES with foreignKeyField: 'userId'\n // - userId field is on USER_PROFILES, pointing to USERS\n // - USERS is the parent of USER_PROFILES\n //\n // NOTE: FK reference relationships (like TODOS → USERS with assignedToUserId)\n // where resourceType1 has a FK field pointing to resourceType2 are handled separately\n // at URL generation time, not here.\n // See: resources-config-operations.urls-builder.utils.ts:generateSyntheticFKParents()\n\n // F-8 fix: Filter out disabled relationships at the source.\n // All downstream consumers (ResourceContext, ServicesRegistryHandler, ContainerNested,\n // DTO builder) receive these categorized arrays, so filtering here prevents disabled\n // relationships from being processed anywhere in the pipeline.\n const activeRelationships = resourceRelationships.filter(rel => !rel.isDisabled);\n\n const isManyToMany = (rel: ResourceRelationship) =>\n rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n rel.jointResourceType;\n\n const processedResourceRelationships: ResourceConfiguration_ResourceRelationships = {\n // Filter out M:N relationships — they're peer relationships via a junction table,\n // transformed into synthetic 1:N relationships in the M:N processing section below.\n parentRelationships: activeRelationships.filter(rel =>\n rel.resourceType2 === resourceIdentifier &&\n rel.resourceType1 !== resourceIdentifier &&\n !isManyToMany(rel)\n ),\n childRelationships: activeRelationships.filter(rel =>\n rel.resourceType1 === resourceIdentifier &&\n rel.resourceType2 !== resourceIdentifier &&\n !isManyToMany(rel)\n ),\n // Self-referencing 1:N/1:1 relationships (tree/graph structures).\n // M:N self-refs are excluded — they're handled entirely through M:N decomposition\n // (synthetic junction-table relationships go into parent/child buckets).\n selfRelationships: activeRelationships.filter(rel =>\n rel.resourceType1 === resourceIdentifier && rel.resourceType2 === resourceIdentifier &&\n !isManyToMany(rel)\n ),\n };\n\n // ========================================\n // PROCESS MANY-TO-MANY JOINT RESOURCE RELATIONSHIPS\n // ========================================\n\n const compileSyntheticRelationship = (\n relationshipDeclaration: ResourceRelationshipDeclaration\n ): ResourceRelationship =>\n Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n\n /**\n * Build the synthetic **scope-anchored peer-under-scope** edge for an M:N\n * (scope-required reference search). It makes a target peer `T` addressable\n * UNDER the other peer `S` for SEARCH/LIST ONLY — e.g.\n * `/organizations/{organizationId}/users/search` — and tags it with the\n * junction `J` so the backend (a) scopes the `T` query via a junction subquery\n * (`T._id ∈ { J.targetFk : J.scopeFk = S_id }` — `T` holds no real FK column\n * for `S`) and (b) authorizes by `S`-membership instead of `T`'s own scope.\n * `OPTIONAL_CONTEXT` so the bare `/users/search` (global) route also survives;\n * `urlOperationScope` keeps this off READ/CREATE/UPDATE/DELETE routes (a\n * peer-under-scope path is a read-only access pattern).\n */\n const buildScopeAnchoredPeerEdge = (\n scopeType: ResourceType,\n targetType: ResourceType,\n junction: ResourceType,\n isDisabled: boolean,\n ): ResourceRelationship =>\n compileSyntheticRelationship({\n cardinality1: ResourceRelationshipCardinality.ONE, // one scope S\n cardinality2: ResourceRelationshipCardinality.MANY, // many targets T\n resourceType1: scopeType, // S — the URL parent (anchor scope)\n resourceType2: targetType, // T — the searched collection (current peer)\n nature: RelationshipNature.REFERENCE,\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n isPrimaryScope: false,\n isDisabled,\n allowCycle: false,\n scopeViaJunction: junction,\n urlOperationScope: [CoreResourceOperation.SEARCH, CoreResourceOperation.LIST],\n });\n\n // Find many-to-many relationships with joint resource types (from ALL active relationships,\n // including those with discriminators — a conditional M:N is still an M:N)\n const manyToManyRelationships = activeRelationships.filter(rel =>\n rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n rel.jointResourceType\n );\n\n // Additional relationships to add based on many-to-many joint resource logic\n const additionalRelationships: ResourceRelationship[] = [];\n\n manyToManyRelationships.forEach(m2mRel => {\n Resources_SharedUtils.assertSupportedManyToManySyntheticExpansion(m2mRel);\n const { resourceType1: entity1Type, resourceType2: entity2Type, jointResourceType, foreignKeyField } = m2mRel;\n\n if (resourceIdentifier === jointResourceType) {\n // ========================================\n // JUNCTION TABLE: Current resource IS the joint resource\n // ========================================\n // For many-to-many, the junction table can be accessed from BOTH sides:\n // - /organizations/{orgId}/organization-members\n // - /users/{userId}/organization-members\n // Both parents use OPTIONAL_CONTEXT so each generates independent URL paths\n //\n // NOTE: Junction table parent relationships do NOT carry discriminator/condition\n // from the original M:N. The junction table itself doesn't need condition awareness —\n // it's the entity→junction direction that carries conditions, because the entity\n // is the \"parent\" whose data is evaluated. The junction table looks UP to both\n // entities as parents, and parent traversal intentionally skips discriminator checks\n // (see fetchParentResourcesWithPolicy in ResourceContextBackendService).\n\n // Relationship: entity1 → joint resource (entity1 is a parent of junction table)\n const relationFromEntity1 = compileSyntheticRelationship({\n cardinality1: ResourceRelationshipCardinality.ONE, // One entity1\n cardinality2: ResourceRelationshipCardinality.MANY, // Many joint records\n resourceType1: entity1Type, // entity1 (e.g., ORGANIZATIONS)\n resourceType2: resourceIdentifier, // joint resource (e.g., ORGANIZATION_MEMBERS)\n jointResourceType,\n nature: m2mRel.resolvedSemantics.nature,\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n isPrimaryScope: false,\n isDisabled: m2mRel.isDisabled || false,\n allowCycle: false,\n // Preserve context policy and childOperations from original relationship\n contextPolicy: m2mRel.contextPolicy,\n read: m2mRel.read,\n childOperations: m2mRel.childOperations,\n foreignKeyField: m2mRel.foreignKeyField,\n });\n additionalRelationships.push(relationFromEntity1);\n\n // Relationship: entity2 → joint resource (entity2 is ALSO a parent of junction table)\n const relationFromEntity2 = compileSyntheticRelationship({\n cardinality1: ResourceRelationshipCardinality.ONE, // One entity2\n cardinality2: ResourceRelationshipCardinality.MANY, // Many joint records\n resourceType1: entity2Type, // entity2 (e.g., USERS)\n resourceType2: resourceIdentifier, // joint resource (e.g., ORGANIZATION_MEMBERS)\n jointResourceType,\n nature: m2mRel.resolvedSemantics.nature,\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT, // Both sides are optional\n isPrimaryScope: false,\n isDisabled: m2mRel.isDisabled || false,\n allowCycle: false,\n // Preserve context policy and childOperations from original relationship\n contextPolicy: m2mRel.contextPolicy,\n read: m2mRel.read,\n childOperations: m2mRel.childOperations,\n // For M:N self-referencing, foreignKeyField distinguishes source/target in junction table\n foreignKeyField: foreignKeyField,\n });\n additionalRelationships.push(relationFromEntity2);\n\n } else if (resourceIdentifier === entity1Type) {\n // ========================================\n // ENTITY1: Current resource is the first entity in the relationship\n // ========================================\n // Entity1 has junction table as child (for child relationships).\n // The synthetic entity→junction relationship DOES carry discriminator/condition\n // from the original M:N declaration (lines below). This ensures that conditional\n // M:N relationships (e.g., \"users have projects only when role=DEVELOPER\") are\n // correctly gated at runtime when looking DOWN from entity1 to the junction.\n\n if (!jointResourceType)\n throw createConfigurationError(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n\n const relationToJoint = compileSyntheticRelationship({\n cardinality1: ResourceRelationshipCardinality.ONE, // One entity\n cardinality2: ResourceRelationshipCardinality.MANY, // Many joint records\n resourceType1: resourceIdentifier, // current entity\n resourceType2: jointResourceType, // joint resource\n jointResourceType,\n nature: m2mRel.resolvedSemantics.nature,\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n isPrimaryScope: false,\n isDisabled: m2mRel.isDisabled || false,\n allowCycle: m2mRel.allowCycle || false,\n contextPolicy: m2mRel.contextPolicy,\n read: m2mRel.read,\n childOperations: m2mRel.childOperations,\n foreignKeyField: m2mRel.foreignKeyField,\n discriminator: m2mRel.discriminator,\n condition: m2mRel.condition,\n display: m2mRel.display,\n });\n additionalRelationships.push(relationToJoint);\n\n // Scope-anchored read edge: this resource (entity1, the target T) becomes\n // addressable under entity2 (the scope S) for SEARCH/LIST via the junction.\n additionalRelationships.push(\n buildScopeAnchoredPeerEdge(entity2Type, resourceIdentifier, jointResourceType, m2mRel.isDisabled || false),\n );\n\n } else if (resourceIdentifier === entity2Type) {\n // ========================================\n // ENTITY2: Current resource is the second entity in the relationship\n // ========================================\n // Entity2 also has junction table as child (for child relationships).\n // Same as Entity1: carries discriminator/condition from the M:N declaration\n // to enable conditional gating when looking DOWN from entity2 to the junction.\n\n if (!jointResourceType)\n throw createConfigurationError(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n\n const relationToJoint = compileSyntheticRelationship({\n cardinality1: ResourceRelationshipCardinality.ONE, // One entity\n cardinality2: ResourceRelationshipCardinality.MANY, // Many joint records\n resourceType1: resourceIdentifier, // current entity\n resourceType2: jointResourceType, // joint resource\n jointResourceType,\n nature: m2mRel.resolvedSemantics.nature,\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n isPrimaryScope: false,\n isDisabled: m2mRel.isDisabled || false,\n allowCycle: m2mRel.allowCycle || false,\n contextPolicy: m2mRel.contextPolicy,\n read: m2mRel.read,\n childOperations: m2mRel.childOperations,\n foreignKeyField: foreignKeyField,\n discriminator: m2mRel.discriminator,\n condition: m2mRel.condition,\n display: m2mRel.display,\n });\n additionalRelationships.push(relationToJoint);\n\n // Scope-anchored read edge: this resource (entity2, the target T) becomes\n // addressable under entity1 (the scope S) for SEARCH/LIST via the junction.\n additionalRelationships.push(\n buildScopeAnchoredPeerEdge(entity1Type, resourceIdentifier, jointResourceType, m2mRel.isDisabled || false),\n );\n }\n });\n\n // Add the additional relationships to the appropriate categories\n additionalRelationships.forEach(rel => {\n if (rel.resourceType2 === resourceIdentifier && rel.resourceType1 !== resourceIdentifier) {\n processedResourceRelationships.parentRelationships.push(rel);\n } else if (rel.resourceType1 === resourceIdentifier && rel.resourceType2 !== resourceIdentifier) {\n processedResourceRelationships.childRelationships.push(rel);\n } else if (rel.resourceType1 === resourceIdentifier && rel.resourceType2 === resourceIdentifier) {\n processedResourceRelationships.selfRelationships.push(rel);\n }\n });\n\n // Create set of available parent resource types for validation.\n // Includes selfRelationships because a self-ref acts as its own parent (tree roots).\n const availableParentResourceTypes = new Set([\n ...processedResourceRelationships.parentRelationships.map(rel => rel.resourceType1),\n ...processedResourceRelationships.selfRelationships.map(rel => rel.resourceType1),\n ]);\n\n return {\n processedResourceRelationships,\n availableParentResourceTypes\n };\n}\n\n/**\n * Processes parent resource access scope strategy overrides for an operation.\n *\n * Creates a shallow copy of the relationship buckets with overridden `accessScopeStrategy`\n * values for specific parent resource types. This allows per-operation customization of\n * how parent resources are resolved in URL paths (e.g., making an optional parent\n * mandatory for a specific operation).\n *\n * The returned object has exactly three fields: `parentRelationships`, `childRelationships`,\n * `selfRelationships`. There is no `inheritanceSchemaRelationships` field — that structure\n * was removed as part of the relationship condition refactor.\n *\n * @param resourceRelationships - The base relationship buckets (from transformResourceRelationships)\n * @param availableParentResourceTypes - Set of valid parent resource types for validation\n * @param parentResourceAccessScopeStrategyOverrides - Overrides to apply\n * @param operationIdentifier - The operation name (for error messages)\n * @returns A new ResourceConfiguration_ResourceRelationships with overrides applied\n */\nfunction processParentResourceAccessScopeStrategyOverrides(\n resourceRelationships: ResourceConfiguration_ResourceRelationships,\n availableParentResourceTypes: Set<ResourceType>,\n parentResourceAccessScopeStrategyOverrides: { resourceType: ResourceType, accessScopeStrategy: ResourceRelationshipAccessScopeStrategy }[],\n operationIdentifier: string\n): ResourceConfiguration_ResourceRelationships {\n if (!parentResourceAccessScopeStrategyOverrides || parentResourceAccessScopeStrategyOverrides.length === 0) {\n return resourceRelationships;\n }\n\n // Validate that all override resources exist in parent relationships\n for (const override of parentResourceAccessScopeStrategyOverrides) {\n if (!availableParentResourceTypes.has(override.resourceType)) {\n throw createConfigurationError(`Operation '${operationIdentifier}' has access scope strategy override for parent resource '${override.resourceType}' but it's not available in parent relationships`);\n }\n }\n\n // Create a map for quick lookup of overrides\n const overrideMap = new Map<ResourceType, ResourceRelationshipAccessScopeStrategy>();\n parentResourceAccessScopeStrategyOverrides.forEach(override => {\n overrideMap.set(override.resourceType, override.accessScopeStrategy);\n });\n\n const applyOverride = (rel: ResourceRelationship): ResourceRelationship => {\n const overrideStrategy = overrideMap.get(rel.resourceType1);\n return overrideStrategy !== undefined ? { ...rel, accessScopeStrategy: overrideStrategy } : rel;\n };\n\n const updatedResourceRelationships: ResourceConfiguration_ResourceRelationships = {\n parentRelationships: resourceRelationships.parentRelationships.map(applyOverride),\n childRelationships: [...resourceRelationships.childRelationships],\n // Self-refs act as their own parent — scope strategy overrides must apply.\n selfRelationships: resourceRelationships.selfRelationships.map(applyOverride),\n };\n\n return updatedResourceRelationships;\n}\n\n/**\n * Processes user notifications by adding primaryScope and auto-generating identifiers\n * Format: ${resourceIdentifier}_${operationIdentifier}_${target}_${customNotificationRef?}_${userRoles.join(\"_\")}_${level}\n *\n * Validates that when there are 2+ notifications with the same target in the same operation,\n * each one must have a unique customNotificationRef to distinguish them.\n */\nfunction processUserNotifications(\n userNotifications: UserNotificationDefinitionWithoutPrimaryScopeAndIdentifier[],\n resourceIdentifier: ResourceType,\n operationIdentifier: string,\n resourcePrimaryScope: ResourcePrimaryScope\n): UserNotificationDefinition[] {\n\n // ========================================\n // VALIDATE DUPLICATE TARGET NOTIFICATIONS\n // ========================================\n\n // Group notifications by target+channel to find duplicates\n const notificationsByTargetChannel = new Map<string, UserNotificationDefinitionWithoutPrimaryScopeAndIdentifier[]>();\n userNotifications.forEach(n => {\n const key = `${n.target}_${n.channel}`;\n if (!notificationsByTargetChannel.has(key)) {\n notificationsByTargetChannel.set(key, []);\n }\n notificationsByTargetChannel.get(key)!.push(n);\n });\n\n // Validate customNotificationRef for groups with 2+ notifications\n for (const [targetChannel, notifications] of notificationsByTargetChannel.entries()) {\n if (notifications.length >= 2) {\n // Check that all have customNotificationRef\n const missingRefs = notifications.filter(n => !n.customNotificationRef);\n if (missingRefs.length > 0) {\n throw createConfigurationError(\n `Operation '${resourceIdentifier}_${operationIdentifier}' has ${notifications.length} notifications with target_channel '${targetChannel}'. ` +\n `When there are 2+ notifications with the same target, each must have a unique 'customNotificationRef' to distinguish them. ` +\n `${missingRefs.length} notification(s) are missing customNotificationRef.`\n );\n }\n\n // Check that all customNotificationRefs are unique\n const refs = notifications.map(n => n.customNotificationRef);\n const uniqueRefs = new Set(refs);\n if (uniqueRefs.size !== refs.length) {\n throw createConfigurationError(\n `Operation '${resourceIdentifier}_${operationIdentifier}' has duplicate customNotificationRef values for target_channel '${targetChannel}'. ` +\n `Each notification with the same target must have a unique customNotificationRef. ` +\n `Found refs: [${refs.join(', ')}]`\n );\n }\n }\n }\n\n // ========================================\n // GENERATE IDENTIFIERS\n // ========================================\n\n return userNotifications.map(notification => {\n // Auto-generate identifier: ${resourceIdentifier}_${current_operation}_${target}_${customNotificationRef?}_${userRoles.join(\"_\")}_${level}\n const identifierParts = [\n resourceIdentifier,\n operationIdentifier,\n notification.target\n ];\n\n // Add customNotificationRef if present (for disambiguation)\n if (notification.customNotificationRef) {\n identifierParts.push(notification.customNotificationRef);\n }\n\n // Add userRoles if present\n if (notification.userRoles && notification.userRoles.length > 0) {\n identifierParts.push(notification.userRoles.join(\"_\"));\n }\n\n // Add level if present\n if (notification.level) {\n identifierParts.push(notification.level);\n }\n\n const autoGeneratedIdentifier = identifierParts.join(\"_\");\n\n return {\n ...notification,\n identifier: autoGeneratedIdentifier,\n primaryScope: resourcePrimaryScope\n };\n });\n}\n\n/**\n * Processes M2M notifications by auto-generating identifiers\n * Format: ${resourceIdentifier}_${operationIdentifier}_${channel}\n */\nfunction processM2MNotifications(\n m2mNotifications: M2MNotificationDefinitionWithoutIdentifier[],\n resourceIdentifier: ResourceType,\n operationIdentifier: string\n): M2MNotificationDefinitionWithoutIdentifier[] {\n return m2mNotifications.map(notification => {\n // Auto-generate identifier: ${resourceIdentifier}_${current_operation}_${channel}\n const autoGeneratedIdentifier = [\n resourceIdentifier,\n operationIdentifier,\n notification.channel\n ].join(\"_\");\n\n return {\n ...notification,\n identifier: autoGeneratedIdentifier\n };\n });\n}\n\n// --------------------------------\n// Resources Pagination Response\n// --------------------------------\n\n\nfunction createResourcePaginatedResponseSchema<T extends z.ZodTypeAny>(params: {\n dataSchema: T;\n validateArrayConstraints?: boolean;\n maxResultsPerPageLimit?: number;\n}): z.ZodType<ResourcePaginatedResponseResultSchema<T>> {\n\n const {\n dataSchema,\n validateArrayConstraints = true,\n maxResultsPerPageLimit = 50\n } = params;\n\n // Comprehensive parameter validation\n if (!dataSchema) {\n throw createConfigurationError('Data schema is required and cannot be null or undefined');\n }\n\n // Use duck typing instead of instanceof to avoid version conflicts\n if (typeof dataSchema !== 'object' ||\n typeof dataSchema.parse !== 'function' ||\n typeof dataSchema.safeParse !== 'function' ||\n !dataSchema._def) {\n throw createConfigurationError(`Data schema must be a valid Zod schema type. Got: ${typeof dataSchema}, constructor: ${dataSchema?.constructor?.name}`);\n }\n\n if (validateArrayConstraints) {\n if (typeof maxResultsPerPageLimit !== 'number' || maxResultsPerPageLimit < 0) {\n throw createConfigurationError('Max results per page limit must be a non-negative number');\n }\n }\n\n // Create strongly typed array schema with optional constraints\n const createDataArraySchema = (schema: T) => {\n let arraySchema = z.array(schema);\n\n if (validateArrayConstraints) {\n if (maxResultsPerPageLimit > 0) {\n arraySchema = arraySchema.max(maxResultsPerPageLimit, `Data array cannot contain more than ${maxResultsPerPageLimit} items`);\n }\n }\n\n return arraySchema;\n };\n\n // Runtime validation with comprehensive error messages\n const validatePaginatedResponse = (input: any): input is ResourcePaginatedResponseResultSchema<T> => {\n // Validate root structure\n if (!input || typeof input !== 'object') {\n throw createValidationError('Paginated response must be an object');\n }\n\n // Validate data field existence\n if (!('data' in input)) {\n throw createValidationError('Paginated response must have a \"data\" field');\n }\n\n // Validate data is an array\n if (!Array.isArray(input.data)) {\n throw createValidationError('Data field must be an array');\n }\n\n // Validate array constraints if enabled\n if (validateArrayConstraints) {\n if (input.data.length > maxResultsPerPageLimit) {\n throw createValidationError(`Data array cannot contain more than ${maxResultsPerPageLimit} items, got ${input.data.length}`);\n }\n }\n\n // Validate pagination field existence\n if (!('pagination' in input)) {\n throw createValidationError('Paginated response must have a \"pagination\" field');\n }\n\n // Validate pagination structure\n if (!input.pagination || typeof input.pagination !== 'object') {\n throw createValidationError('Pagination field must be an object');\n }\n\n // Validate required pagination fields\n const requiredPaginationFields = ['page', 'limit', 'total', 'totalPages'];\n for (const field of requiredPaginationFields) {\n if (!(field in input.pagination)) {\n throw createValidationError(`Pagination must have a \"${field}\" field`);\n }\n\n if (typeof input.pagination[field] !== 'number') {\n throw createValidationError(`Pagination \"${field}\" must be a number`);\n }\n\n if (input.pagination[field] < 0) {\n throw createValidationError(`Pagination \"${field}\" must be non-negative`);\n }\n }\n\n // Validate pagination logic\n if (input.pagination.page > input.pagination.totalPages && input.pagination.totalPages > 0) {\n throw createValidationError('Current page cannot exceed total pages');\n }\n\n if (input.pagination.limit <= 0) {\n throw createValidationError('Pagination limit must be positive');\n }\n\n return true;\n };\n\n // Create the result schema with comprehensive validation\n const resultSchema = z.object({\n data: createDataArraySchema(dataSchema),\n // Bounded by the SAME ceiling as the data array above. `limit` reports the page size actually\n // served, so a stricter bound here rejects pages this very schema just declared valid.\n pagination: createPaginationResponseMetadataSchema(maxResultsPerPageLimit)\n }).refine(validatePaginatedResponse, {\n message: \"Invalid paginated response structure\"\n });\n\n return resultSchema as z.ZodType<ResourcePaginatedResponseResultSchema<T>>;\n}\n\n\n\n// --------------------------------\n// Resource Search Query Request\n// --------------------------------\n\n/**\n * The ONE authority for the `{ pagination, sorting, filters }` argument envelope every\n * collection-shaped operation accepts.\n *\n * Exported rather than factory-private because a second surface needs the identical shape: the MCP\n * tool adapter advertises this envelope for collection tools whose `requestDto` is empty. A LIST\n * operation keeps `requestDto: z.object({})` — its filters travel in the QUERY STRING over HTTP, so\n * giving it a request BODY would misdescribe the REST contract and the generated OpenAPI — yet the\n * MCP dispatch normalises the very same envelope for it. Advertising had to be fixed without\n * touching the DTO, and that means this builder is reachable from both places.\n *\n * Deriving the shape a second time in the adapter was the rejected alternative: a filter allow-list\n * that drifts between the surface that ADVERTISES it and the surface that ENFORCES it is precisely\n * the defect class this envelope already caused once.\n */\nexport function createResourceSearchQueryRequestSchema<\n TFilterFields extends Record<string, PrimitiveZodType> | undefined,\n TSortFields extends readonly string[] | undefined,\n>(params: {\n filterFields: TFilterFields;\n allowedSortFields: TSortFields;\n pagination: boolean;\n /**\n * The operation's declared page ceiling, mirrored onto the REQUEST side.\n *\n * Without it the request DTO refuses any `pagination.limit` above a hard-coded 100 while the\n * repository and the response DTO both honour the declared value — so an operation declaring 200\n * advertises a limit it answers **400** to. Found 2026-08-12 by an e2e probe asking `users SEARCH`\n * (declared 200) for 120: `pagination.limit: Too big: expected number to be <=100`.\n *\n * Defaults to 100 — the bound this schema has always enforced — so an un-migrated caller keeps\n * exactly its current contract.\n */\n maxPaginatedResultPerPageLimit?: number;\n}): ResourceSearchQueryRequestResult<TFilterFields, TSortFields> {\n\n const { filterFields, allowedSortFields = [], pagination = true, maxPaginatedResultPerPageLimit } = params;\n\n // Validate input parameters\n if (filterFields !== undefined && typeof filterFields !== 'object') {\n throw createConfigurationError('Filter fields must be an object');\n }\n\n if (allowedSortFields && !Array.isArray(allowedSortFields)) {\n throw createConfigurationError('Allowed sort fields must be an array');\n }\n\n if (allowedSortFields && allowedSortFields.length > 0 && !allowedSortFields.every(field => typeof field === 'string' && field.length > 0)) {\n throw createConfigurationError('All sort fields must be non-empty strings');\n }\n\n // Strongly typed filter schema creation\n const createFilterSchema = <T extends Record<string, PrimitiveZodType>>(fields: T) => {\n const processedFields: Record<string, z.ZodOptional<any>> = {};\n\n Object.entries(fields).forEach(([key, schema]) => {\n // Type-safe schema processing based on schema type\n if (schema instanceof z.ZodDate) {\n processedFields[key] = Resources_Filter_DateRangeSchema.optional();\n } else if (schema instanceof z.ZodString) {\n processedFields[key] = (schema as z.ZodString).optional();\n } else if (schema instanceof z.ZodNumber) {\n processedFields[key] = (schema as z.ZodNumber).optional();\n } else if (schema instanceof z.ZodBoolean) {\n processedFields[key] = (schema as z.ZodBoolean).optional();\n } else if (schema instanceof z.ZodEnum) {\n processedFields[key] = (schema as z.ZodEnum<any>).optional();\n } else {\n // Fallback for other primitive types\n processedFields[key] = (schema as z.ZodTypeAny).optional();\n }\n });\n\n return Resources_Filter_BaseSchema.extend(processedFields);\n };\n\n // Strongly typed sorting schema creation\n const createSortingSchema = (fields: readonly string[]) => {\n const sortingFields: Record<string, z.ZodOptional<z.ZodObject<any>>> = {};\n\n fields.forEach(field => {\n sortingFields[field] = z.object({\n field: z.literal(field),\n order: z.enum(SortOrder).default(SortOrder.ASC),\n priority: z.number().min(0).default(0)\n }).optional();\n });\n\n return z.object(sortingFields).optional();\n };\n\n\n // Build the schema dynamically based on parameters\n const schemaConfig: any = {};\n\n // Add pagination if enabled.\n //\n // Built from the operation's ceiling rather than the shared default-bounded constant, so the limit\n // a caller may REQUEST, the limit the repository will SERVE and the limit the response DTO ACCEPTS\n // are one number. They were three, and the request side was the strictest — which is why a\n // declared ceiling above 100 was unreachable over HTTP no matter what the other two allowed.\n if (pagination) {\n schemaConfig.pagination = createPaginationRequestSchema(maxPaginatedResultPerPageLimit).optional();\n }\n\n // Add sorting if allowed fields are provided\n if (allowedSortFields && allowedSortFields.length > 0) {\n schemaConfig.sorting = createSortingSchema(allowedSortFields);\n }\n\n // Add filtering based on filter fields\n if (filterFields !== undefined && Object.keys(filterFields).length > 0) {\n schemaConfig.filters = createFilterSchema(filterFields).optional();\n } else {\n schemaConfig.filters = Resources_Filter_BaseSchema.optional();\n }\n\n // Create the final schema with validation\n const resultSchema = z.object(schemaConfig);\n\n return resultSchema as ResourceSearchQueryRequestResult<TFilterFields, TSortFields>;\n}\n\n\n\n\n\n// Helper function to determine HTTP verb based on operation\nfunction getDefaultHttpVerbForOperation(operation: string): HttpMethod {\n switch (operation) {\n case CoreResourceOperation.READ:\n case CoreResourceOperation.LIST:\n case CoreResourceOperation.SEARCH:\n case CoreResourceOperation.COUNT:\n return HttpMethod.GET;\n case CoreResourceOperation.CREATE:\n case CoreResourceOperation.CREATE_MANY:\n return HttpMethod.POST;\n case CoreResourceOperation.UPDATE:\n case CoreResourceOperation.UPDATE_MANY:\n return HttpMethod.PUT;\n case CoreResourceOperation.DELETE:\n case CoreResourceOperation.DELETE_MANY:\n return HttpMethod.DELETE;\n default:\n return HttpMethod.POST; // Default for unknown operations\n }\n}\n\n/**\n * Determines if an operation variant should be marked as the default operation within its variantType group\n * Handles the complex logic for single vs multiple variants and explicit defaults\n *\n * Rules after validation:\n * 1. If only one variant exists in the group, it becomes the group default UNLESS the author\n * explicitly opted it out with `isDefault: false`. An omitted/`undefined` `isDefault` still\n * becomes the group default — only an explicit `false` is honored.\n *\n * Rationale: a sole `isDefault: false` variant is a real authoring signal that this transport\n * has NO default for the operation. Example: `users.list` declares an `INTERNAL_CALL` default\n * plus a single keyed `API_CALL` \"admin\" variant marked `isDefault: false` — there is no public\n * default URL listing, only the admin-keyed one. The prior behavior force-defaulted such a\n * variant, which (a) contradicted author intent and (b) produced two `isOperationDefault === true`\n * operations for one operation identifier across transport groups (one per group) — a latent\n * hazard for any consumer that filters defaults across transports (e.g. a set-filter that matches\n * >1 and throws). Honoring the explicit `false` keeps each transport group with at most one\n * default and makes the variant resolvable only via its keyed path resolver, which is the intent.\n * See `.claude/plans/internal-call-operation-path-resolution.md` (D6 + RESOLUTION).\n * 2. If multiple variants exist in the group, validation requires exactly one `isDefault=true`.\n * 3. Fallback selection is kept for direct/test-only callers that bypass factory validation,\n * but authored multi-variant groups must never rely on array order.\n */\nfunction determineOperationVariantDefault(\n variantsOfSameType: ResourceConfiguration_OperationVariant_BuilderParameters<any>[],\n currentVariant: ResourceConfiguration_OperationVariant_BuilderParameters<any>\n): boolean {\n // Rule 1: A single variant of this type is the group default UNLESS the author\n // explicitly opted out with `isDefault: false`. An omitted/`undefined` `isDefault`\n // still becomes the default — only an explicit `false` is honored (see JSDoc above).\n if (variantsOfSameType.length === 1) {\n return currentVariant.isDefault !== false;\n }\n\n // Rule 2: Find explicit isDefault=true within this variant type group\n const explicitDefaultVariant = variantsOfSameType.find(variant =>\n variant.isDefault === true\n );\n\n // If we found an explicit default, check if current variant is it\n if (explicitDefaultVariant) {\n return currentVariant === explicitDefaultVariant;\n }\n\n // Rule 3: No explicit isDefault=true found, use first variant that doesn't have isDefault=false\n const firstNonFalseVariant = variantsOfSameType.find(variant =>\n variant.isDefault !== false\n );\n\n if (firstNonFalseVariant) {\n return currentVariant === firstNonFalseVariant;\n }\n\n // Fallback: if all variants have isDefault=false, first one becomes default anyway\n return currentVariant === variantsOfSameType[0];\n}\n\nconst RESERVED_OPERATION_VARIANT_KEYS = new Set([\n 'isdefault',\n 'novariantkey',\n]);\nconst AUTO_OPERATION_VARIANT_KEYS = new Set([\n OPERATION_VARIANT_KEY.SUMMARY,\n OPERATION_VARIANT_KEY.CONTEXT,\n]);\n\nfunction isDataModeVariantKeyAllowedForOperation(\n operation: string,\n variant: ResourceConfiguration_OperationVariant_BuilderParameters<any>,\n): boolean {\n const effectiveOperation = variant.resourceOperationLike ?? operation;\n return effectiveOperation === CoreResourceOperation.READ\n || effectiveOperation === CoreResourceOperation.LIST\n || effectiveOperation === CoreResourceOperation.SEARCH;\n}\n\n// --------------------------------\n// Resources Shared Configuration\n// --------------------------------\n\n/**\n * Creates a resource configuration from builder parameters.\n * NOTE: TDatabaseSchema has been removed. Backend-only fields are now marked with\n * the isBackendOnly decorator in mainSchema and are stripped at the service layer.\n */\nexport function createResourceConfiguration_Initialization<\n TCustomOperationEnum extends EnumLikeType | undefined,\n TCoreOperationEnum extends Partial<CoreResourceOperation> | undefined,\n TMainSchema extends z.ZodTypeAny,\n>(params: ResourceConfiguration_BuilderParameters<\n TCustomOperationEnum, TCoreOperationEnum, TMainSchema\n>): ResourceConfiguration<TCustomOperationEnum, TCoreOperationEnum, TMainSchema> {\n\n const {\n mainSchema,\n resourceIdentifier,\n resourceFieldIdentifier,\n resourceRelationships,\n inheritenceSchemaDefinition,\n isSystemResource = false,\n // Defaulted TRUE — the safe direction. A resource that never considered whether its primary key\n // names the caller keeps the identity-coherence refusal; only a deliberate `false` relaxes it.\n primaryKeyIdentifiesInitiator = true,\n // Fail-closed default: a resource that does not author `systemAccessPolicy`\n // gets an explicit all-verbs-FORBIDDEN policy, so the resolved config is\n // self-documenting and every system-context primitive\n // (`readAsSystem`/`listAsSystem` and the trusted\n // `createAsSystem`/`updateAsSystem`/`updateManyAsSystem` writes) rejects it\n // by default.\n systemAccessPolicy = {\n read: ResourceSystemAccessMode.FORBIDDEN,\n list: ResourceSystemAccessMode.FORBIDDEN,\n create: ResourceSystemAccessMode.FORBIDDEN,\n update: ResourceSystemAccessMode.FORBIDDEN,\n updateMany: ResourceSystemAccessMode.FORBIDDEN,\n },\n isAnonymizable = false,\n transpositionPolicy,\n retentionPolicy,\n dataSubjectPolicy,\n portabilityPolicy,\n persistenceAdapter,\n persistenceAdapterIsolation,\n httpApiBinding,\n introspectionBinding,\n coreOperations,\n customOperation,\n operationsConfiguration,\n } = params;\n\n /**\n * HTTP_API ↔ binding coherence — enforced at AUTHORING, both directions, because each half\n * alone is a contradiction the backend could only discover later and worse:\n * - `HTTP_API` without a binding is a resource whose rows live \"somewhere over HTTP\" with no\n * target, key, identity or erasure story — nothing downstream can repair that;\n * - a binding on a platform-backed resource is a declaration nothing will ever read, i.e. a\n * config that LOOKS externally bound and silently is not.\n * The binding's CONTENT is validated here too (Zod parse) so a malformed declaration names its\n * defect at the factory, not at boot. (ETL plan Step 3; registration-time checks that need the\n * RESOLVED adapter or the live registry — scope expressibility, retention/anonymizable/scope-root\n * refusals — live in the backend registry validation, which structurally cannot run here.)\n */\n if (persistenceAdapter === PersistenceAdapter.HTTP_API && httpApiBinding === undefined) {\n throw createConfigurationError(\n `[${resourceIdentifier}] persistenceAdapter 'http-api' requires the companion 'httpApiBinding' declaration (provider, dialect, key fields, identity, tenancy, erasure).`\n );\n }\n if (persistenceAdapter === PersistenceAdapter.INTROSPECTION && introspectionBinding === undefined) {\n throw createConfigurationError(\n `[${resourceIdentifier}] persistenceAdapter 'introspection' requires an 'introspectionBinding' naming the companion behavior whose output becomes this resource's rows.`\n );\n }\n if (introspectionBinding !== undefined && persistenceAdapter !== PersistenceAdapter.INTROSPECTION) {\n throw createConfigurationError(\n `[${resourceIdentifier}] 'introspectionBinding' is declared but persistenceAdapter is '${String(persistenceAdapter ?? 'undeclared (application default)')}' — a binding on a stored resource would never be read. Declare persistenceAdapter: 'introspection' or remove the binding.`\n );\n }\n if (httpApiBinding !== undefined && persistenceAdapter !== PersistenceAdapter.HTTP_API) {\n throw createConfigurationError(\n `[${resourceIdentifier}] 'httpApiBinding' is declared but persistenceAdapter is '${String(persistenceAdapter ?? 'undeclared (application default)')}' — a binding on a platform-backed resource would never be read. Declare persistenceAdapter: 'http-api' or remove the binding.`\n );\n }\n /**\n * `persistenceAdapterIsolation` alongside `HTTP_API` is REFUSED, because the claim it makes is\n * one the adapter has already settled — so honouring it would be honouring nothing.\n *\n * The declaration exists to buy a resource admission past the one-adapter rule when it disagrees\n * with the application default: its author asserts the resource takes part in no cross-adapter\n * atomic write, and the resources registry admits it and logs the admitted set. An `HTTP_API`\n * resource is admitted by that same rule WITHOUT any such assertion, on the adapter's own nature —\n * it is not a second platform store, it owns no transactions, and it cannot be an application\n * default. The registry's exemption is therefore ordered BEFORE the isolation branch and returns\n * first, so on an `HTTP_API` resource the isolation claim is never read.\n *\n * Silently ignoring it is the outcome worth preventing. An author who writes the field believes\n * they have bought something, and every later reader believes the resource's admission depends on\n * it — so a future change to the isolation door would look like it affected this resource when it\n * could not. A field whose absence and presence are indistinguishable is worse than a rejected\n * one; this is the same reasoning as the sibling refusal directly above, where a binding on a\n * platform-backed resource is refused precisely because nothing would ever read it.\n */\n if (persistenceAdapter === PersistenceAdapter.HTTP_API && persistenceAdapterIsolation !== undefined) {\n throw createConfigurationError(\n `[${resourceIdentifier}] 'persistenceAdapterIsolation' is declared alongside persistenceAdapter 'http-api', where it is never read — an http-api resource is admitted past the one-adapter rule on the adapter's own nature, not on an isolation claim. Remove the isolation declaration.`\n );\n }\n // The RESOLVED binding, not the authored one. An author writes the schema's INPUT shape\n // (`HttpApiResourceBindingAuthored`), so defaults like `verifyMetadataAtBoot`, `connection` and\n // `remoteCallSemantics` may be absent from what they typed; every consumer reads the parsed shape\n // and is entitled to find them. The parse result used to be DISCARDED — harmless only because\n // authoring demanded every field, which is precisely the burden the authored shape removes.\n const resolvedHttpApiBinding = httpApiBinding === undefined ? undefined : (() => {\n const bindingParse = HttpApiResourceBindingSchema.safeParse(httpApiBinding);\n if (!bindingParse.success) {\n throw createConfigurationError(\n `[${resourceIdentifier}] invalid httpApiBinding declaration: ${bindingParse.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`).join('; ')}`\n );\n }\n try {\n assertHttpApiBindingDialectCoherence(bindingParse.data);\n } catch (error) {\n throw createConfigurationError(\n `[${resourceIdentifier}] invalid httpApiBinding declaration: ${error instanceof Error ? error.message : String(error)}`\n );\n }\n return bindingParse.data;\n })();\n\n /**\n * `externalDataPipeline` — the inbound ETL pipeline on an ordinary LOCAL resource (partial-resource\n * coverage v3; PR-3/PR-4). Validated at AUTHORING like `httpApiBinding` above: shape (Zod),\n * schema-independent coherence (`assertExternalDataPipelineDeclarationCoherence` — S1 tenancy\n * confinement, unique mapping targets, coercion×dialect), the source binding's own dialect\n * coherence, and every mainSchema-dependent rule:\n *\n * - the pipeline is FORBIDDEN on an HTTP_API-adapter resource (a virtual resource IS the\n * remote side — chaining a pipeline onto read-through would re-create the composite v1\n * rejected);\n * - `remoteKeyLocalField` exists, is a STRING, and is declared `.isBusinessKey()` +\n * `excludeFromCreate` + `excludeFromUpdate` — SYNC's idempotent upsert keys on it and no\n * caller may mint or move it (boot-CHECKED, not factory-mutated: the app author sees the\n * truth in their own schema file);\n * - every mapped local field exists and is `excludeFromCreate`/`excludeFromUpdate`\n * (remote-authoritative — D-P5), and a non-`required` REMOTE_FIELD target must ACCEPT\n * ABSENCE (optional/nullable/default wrapper), or an absent remote value would have nowhere\n * honest to land (v3.1 §3);\n * - `ISO_STRING_TO_DATE` targets must be date fields;\n * - `population: CLOSED` refuses declared caller CREATE operations (D-P8) — INCLUDING a custom\n * operation that is create-shaped through `resourceOperationLike`. Enumerating only\n * `coreOperations` was the earlier, narrower form and it was a real hole: a custom operation\n * is exactly where an author expresses \"mint a row my own way\", so it is the likeliest way\n * into a CLOSED population, not an exotic one.\n */\n const externalDataPipeline = params.externalDataPipeline === undefined ? undefined : (() => {\n const refuse = (message: string): never => {\n throw createConfigurationError(`[${resourceIdentifier}] invalid externalDataPipeline declaration: ${message}`);\n };\n if (persistenceAdapter === PersistenceAdapter.HTTP_API) {\n refuse(\"an HTTP_API-adapter (virtual) resource cannot ALSO declare a pipeline — it IS the remote side; declare the pipeline on the LOCAL destination resource instead.\");\n }\n const declarationParse = ExternalDataPipelineDeclarationSchema.safeParse(params.externalDataPipeline);\n if (!declarationParse.success) {\n refuse(declarationParse.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`).join('; '));\n }\n const declaration = declarationParse.data!;\n try {\n assertExternalDataPipelineDeclarationCoherence(declaration);\n assertHttpApiBindingDialectCoherence(declaration.binding);\n } catch (error) {\n refuse(error instanceof Error ? error.message : String(error));\n }\n\n const shape = getZodObjectShape(mainSchema);\n const requireMappedTarget = (fieldName: string, context: string): z.ZodTypeAny => {\n const fieldSchema = shape[fieldName];\n if (!fieldSchema) refuse(`${context}: local field '${fieldName}' does not exist on mainSchema.`);\n if (!isExcludedFromCreate(fieldSchema!) || !isExcludedFromUpdate(fieldSchema!)) {\n refuse(\n `${context}: local field '${fieldName}' must be declared .excludeFromCreate() and .excludeFromUpdate() — it is REMOTE-AUTHORITATIVE (written only by the pipeline), and the exclusion is also what renders it read-only end to end (DTO → UI).`\n );\n }\n return fieldSchema!;\n };\n\n const keyFieldSchema = requireMappedTarget(declaration.remoteKeyLocalField, 'remoteKeyLocalField');\n if (!(unwrapSchema(keyFieldSchema) instanceof z.ZodString)) {\n refuse(`remoteKeyLocalField: '${declaration.remoteKeyLocalField}' must be a STRING field — it stores the synthesized remote id.`);\n }\n if (!isBusinessKeyField(keyFieldSchema)) {\n refuse(\n `remoteKeyLocalField: '${declaration.remoteKeyLocalField}' must be declared .isBusinessKey() — SYNC's idempotent upsert keys on it, and the business-key declaration is what makes the load MERGE instead of duplicate.`\n );\n }\n // ...and `.isUnique()` ON TOP, which is NOT redundant with the line above: the SQL schema\n // planner derives a UNIQUE constraint from `.isUnique()` and never from `.isBusinessKey()`.\n // Without it the merge contract is upheld only by our own read-then-write, so two concurrent\n // runs of one pipeline can leave TWO rows for one remote row — the exact duplication the whole\n // business-key design exists to prevent, and precisely what a store-level constraint refuses\n // for free.\n //\n // Required rather than suggested because this is an invariant with N call sites (every\n // destination any application ever declares) and a silent failure mode: nothing misbehaves\n // until two runs overlap, and by then the duplicate rows already exist. Found by the first\n // dogfood — the generated migration gave the key a PLAIN index and the omission was invisible\n // in every test, because a single-threaded upsert merges correctly with or without it.\n if (!isUniqueField(keyFieldSchema)) {\n refuse(\n `remoteKeyLocalField: '${declaration.remoteKeyLocalField}' must ALSO be declared .isUnique(). The schema planner derives a UNIQUE constraint from .isUnique() and NOT from .isBusinessKey(), so without it the store would accept two rows for one remote row whenever two runs overlap — the merge would be enforced only by this engine's read-then-write, never by the database.`\n );\n }\n\n for (const entry of declaration.mapping) {\n const targetSchema = requireMappedTarget(entry.localField, `mapping('${entry.localField}')`);\n if (entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD) {\n if (!entry.required && unwrapSchema(targetSchema) === targetSchema) {\n refuse(\n `mapping('${entry.localField}'): a non-required remote field can be ABSENT on a row, and absence lands as null — the target must be optional/nullable/defaulted, or declare required: true (absent rows are then rejected and reported per row).`\n );\n }\n if (entry.coercion === ExternalDataFieldCoercion.ISO_STRING_TO_DATE && !(unwrapSchema(targetSchema) instanceof z.ZodDate)) {\n refuse(`mapping('${entry.localField}'): coercion ISO_STRING_TO_DATE targets a date field.`);\n }\n // ⚠ Odoo spells ABSENT values as literal `false` (v3.1 §3 / PR-8), so on an Odoo source\n // the false→null coercion is the DEFAULT — resolved HERE, at authoring time, because this\n // is the one place the destination field's type is known: a genuine BOOLEAN target keeps\n // its `false` (Odoo booleans really are `false`), everything else would otherwise persist\n // a literal `false` into a string/date/number field. The runtime transform then applies\n // only RESOLVED coercions and carries no schema knowledge.\n if (\n declaration.binding.dialect === HttpApiTransportDialect.ODOO_JSONRPC\n && entry.coercion === ExternalDataFieldCoercion.NONE\n && !(unwrapSchema(targetSchema) instanceof z.ZodBoolean)\n ) {\n entry.coercion = ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL;\n }\n }\n }\n\n if (declaration.population === ExternalDataDestinationPopulation.CLOSED) {\n // Enumerate by the operation's EFFECTIVE semantics, never by its identifier: a CORE operation\n // is its own semantics, while a CUSTOM one declares them per variant through\n // `resourceOperationLike` (the same resolution `isDataModeVariantKeyAllowedForOperation`\n // uses). Both sources are unioned because neither sees the other's members — `coreOperations`\n // can name an operation with no authored configuration entry, and `operationsConfiguration`\n // is where a custom operation exists at all.\n const createShaped: ReadonlySet<unknown> = new Set<unknown>([\n CoreResourceOperation.CREATE,\n CoreResourceOperation.CREATE_MANY,\n ]);\n const declaredCreates = new Set<string>();\n for (const operation of (coreOperations as unknown[])) {\n if (createShaped.has(operation)) declaredCreates.add(String(operation));\n }\n for (const [operationKey, operationConfig] of Object.entries((operationsConfiguration ?? {}) as Record<string, unknown>)) {\n const variants = (operationConfig as { variants?: Array<{ resourceOperationLike?: unknown }> })?.variants ?? [];\n const effectiveOperations: unknown[] = variants.length > 0\n ? variants.map((variant) => variant.resourceOperationLike ?? operationKey)\n : [operationKey];\n if (effectiveOperations.some((effective) => createShaped.has(effective))) {\n declaredCreates.add(operationKey);\n }\n }\n if (declaredCreates.size > 0) {\n refuse(\n `population CLOSED: every row comes from the pipeline, so caller CREATE operations (${[...declaredCreates].sort().join(', ')}) are refused — declare population: OPEN if users may mint rows beside the synced ones. A CUSTOM operation counts when a variant declares a create-shaped resourceOperationLike.`\n );\n }\n }\n\n return declaration;\n })();\n\n const normalizedResourceRelationships = Resources_SharedUtils.ensureCompiledRelationships(\n resourceRelationships\n );\n\n // ========================================\n // VALIDATE DECORATOR COMBINATIONS\n // ========================================\n\n // Validate that mainSchema doesn't have invalid decorator combinations\n validateDecoratorCombinations(mainSchema, resourceIdentifier as string);\n\n // ========================================\n // DERIVE RESOURCE PRIMARY SCOPE\n // ========================================\n //\n // Two derivation signals are permitted (no silent default). A third\n // mechanism — polymorphic factories — is mechanically a special case of (2):\n //\n // 1. SELF-ANCHOR — the resource itself is one of the canonical scope roots\n // (USERS, ORGANIZATIONS, APPLICATION, ANONYMOUS_USERS). The PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE\n // map encodes that bijection.\n //\n // 2. FLAGGED RELATIONSHIP — exactly one relationship involving this resource\n // has `isPrimaryScope: true`. The rel-factory enforces that the flag can\n // only be set on a parent (not a child-side) and that the parent resolves\n // to a known scope-root in the primaryScopeMap, so reading\n // `primaryScopeRelationship.primaryScope` here always yields a valid enum.\n //\n // 3. POLYMORPHIC VARIANT (special case of 2) — resources built via\n // `createPolymorphicResourceConfigurations(...)` (e.g. SSO connections,\n // billing accounts, subscriptions, M2M webhooks). The polymorphic factory\n // auto-injects an `isPrimaryScope: true` rel per declared variant, so each\n // variant resolves through path (2) without the author having to re-declare\n // the anchor manually. If you reach the throw below for a polymorphic\n // resource, the variant declaration is missing its scope mapping — fix\n // the polymorphic config, NOT the registry rel list.\n //\n // If no derivation signal is present we THROW. The framework cannot quietly\n // assume a scope: scope drives auth, notifications, execution context, URL\n // routing, and cross-tenant isolation. A wrong default would be a silent\n // security regression. Every resource author MUST declare scope explicitly\n // via one of the three signals above.\n //\n // Migration: if you hit this throw, add a STANDALONE primary rel from the\n // owning scope-root (e.g. `ORGANIZATIONS → yourResource`,\n // `USERS → yourResource`, `APPLICATION → yourResource`) with\n // `accessScopeStrategy: STANDALONE` and `isPrimaryScope: true`. STANDALONE\n // keeps the rel inert for URL routing while declaring the structural\n // ownership anchor — see `resources-relationships.shared.factory.ts` Guard 1.\n\n const selfScopeEntry = Object.entries(PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE).find(\n ([, coreType]) => coreType === resourceIdentifier\n );\n\n const relevantRelationships = normalizedResourceRelationships.filter(rel =>\n rel.resourceType1 === resourceIdentifier || rel.resourceType2 === resourceIdentifier\n );\n const primaryScopeRelationship = relevantRelationships.find(rel => rel.isPrimaryScope === true);\n\n let resourcePrimaryScope: ResourcePrimaryScope;\n if (selfScopeEntry) {\n resourcePrimaryScope = selfScopeEntry[0] as ResourcePrimaryScope;\n } else if (primaryScopeRelationship?.primaryScope) {\n resourcePrimaryScope = primaryScopeRelationship.primaryScope;\n } else {\n throw createConfigurationError(\n `[${resourceIdentifier}] Cannot derive resourcePrimaryScope.\\n` +\n `\\n` +\n `A resource configuration MUST declare its primary scope via one of:\\n` +\n ` (1) Self-anchor — the resource itself is a canonical scope root\\n` +\n ` (USERS, ORGANIZATIONS, APPLICATION, ANONYMOUS_USERS).\\n` +\n ` (2) Flagged relationship — exactly one parent relationship carries\\n` +\n ` \\`isPrimaryScope: true\\` (parent resolves to a known scope root).\\n` +\n ` (3) Polymorphic variant — resources built via\\n` +\n ` \\`createPolymorphicResourceConfigurations(...)\\` get an\\n` +\n ` \\`isPrimaryScope: true\\` rel auto-injected per variant. If you\\n` +\n ` reach this throw for a polymorphic resource, your variant\\n` +\n ` declaration is missing its scope mapping — fix the polymorphic\\n` +\n ` config, NOT the registry rel list.\\n` +\n `\\n` +\n `No signal was found for resource '${resourceIdentifier}'.\\n` +\n `\\n` +\n `Fix: add a primary-anchor relationship in the registry. For an internal\\n` +\n `resource that should NOT be URL-routed under its scope parent, use:\\n` +\n `\\n` +\n ` createResourcesRelationship(\\n` +\n ` CoreResourceType.ORGANIZATIONS, '${resourceIdentifier as string}',\\n` +\n ` ResourceRelationshipCardinality.ONE, ResourceRelationshipCardinality.MANY,\\n` +\n ` {\\n` +\n ` accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\\n` +\n ` isPrimaryScope: true,\\n` +\n ` nature: RelationshipNature.REFERENCE,\\n` +\n ` contextPolicy: { enabled: false },\\n` +\n ` }\\n` +\n ` )\\n` +\n `\\n` +\n `For a routable child resource, drop the STANDALONE strategy and add\\n` +\n `\\`isPrimaryScope: true\\` to the existing parent relationship.\\n` +\n `\\n` +\n `Background: the framework no longer falls back to a silent ORGANIZATIONS\\n` +\n `default — primary scope drives auth, notifications, execution context,\\n` +\n `URL routing, and cross-tenant isolation, so a wrong default would be a\\n` +\n `silent security regression. See \\`resources-config.shared.factory.ts\\`\\n` +\n `(DERIVE RESOURCE PRIMARY SCOPE) for the full rationale.`\n );\n }\n\n // ========================================\n // isAnonymizable VALIDATION & ENRICHMENT (W7.3a)\n // ========================================\n\n let effectiveMainSchema: TMainSchema = mainSchema;\n let effectiveResourceRelationships = normalizedResourceRelationships;\n let effectiveSystemAccessPolicy = systemAccessPolicy;\n\n if (isAnonymizable) {\n if (resourcePrimaryScope !== ResourcePrimaryScope.USER_SELF) {\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires primaryScope USER_SELF, got ${resourcePrimaryScope}.`\n );\n }\n\n try {\n const shape = getZodObjectShape(mainSchema);\n const userIdField = shape['userId'];\n if (!userIdField) {\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires a 'userId' field in mainSchema.`\n );\n }\n const nullResult = (userIdField as z.ZodTypeAny).safeParse(null);\n if (!nullResult.success) {\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires 'userId' field to accept null ` +\n `(anonymous records have no userId). Use z.string().nullable().`\n );\n }\n } catch (e) {\n if ((e as any)?.type === ErrorType.CONFIGURATION) throw e;\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true but mainSchema is not a ZodObject (cannot validate userId field).`\n );\n }\n\n // PRESENCE half of the anonymizable operation contract: each requirement group must have at\n // least one of its alternatives declared at all. The RESOLVABILITY half — that a declared op\n // has a variant `AnonymousSessionBackendService` can actually dispatch — runs later, once the\n // operation variants are assembled (search `ANONYMIZABLE_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS`).\n // Deliberately two checks, exactly as for `retentionPolicy`, because they have two different\n // fixes: \"declare the op\" vs \"declare it with a service-resolvable variant\".\n for (const { operations: alternatives, primitive, why } of ANONYMIZABLE_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS) {\n if (alternatives.some((alternative) => coreOperations.includes(alternative as any))) {\n continue;\n }\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires ${describeOperationAlternatives(alternatives)} ` +\n `in coreOperations (${primitive}: ${why}).`\n );\n }\n\n effectiveMainSchema = (mainSchema as any).extend({\n anonymousUserId: z.string().optional().nullable().isDBIndexed()\n }) as TMainSchema;\n\n const anonymousRelationship = createResourcesRelationship(\n CoreResourceType.ANONYMOUS_USERS as ResourceType,\n resourceIdentifier,\n ResourceRelationshipCardinality.ONE,\n primaryScopeRelationship!.cardinality2,\n {\n accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.STANDALONE,\n foreignKeyField: 'anonymousUserId',\n parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n nature: primaryScopeRelationship!.resolvedSemantics.nature,\n read: primaryScopeRelationship!.read,\n contextPolicy: { enabled: false },\n childOperations: primaryScopeRelationship!.childOperations?.lifecycle\n ? { lifecycle: primaryScopeRelationship!.childOperations.lifecycle }\n : undefined,\n }\n );\n effectiveResourceRelationships = [...normalizedResourceRelationships, anonymousRelationship];\n\n // ── Derive the transposition system-access grant (W7.3a) ──────────────\n //\n // Anonymous→user ownership transposition (`AnonymousSessionBackendService`)\n // rewrites `{ userId, anonymousUserId }` across every anonymizable resource\n // via `SystemAccessBackendService.updateManyAsSystem`. That primitive is\n // fail-closed on `systemAccessPolicy.updateMany` PER RESOURCE, and both FKs\n // it writes are context-auto-populated names the client-shaped request DTO\n // strips — so WITHOUT the grant the transposition would either throw\n // `CONFIGURATION` (fail-closed) or silently no-op, stranding the converting\n // user's rows under the anonymous id until the cleanup batch deletes them\n // (user-visible data loss).\n //\n // This grant is DERIVED, not authored, precisely because it is not an\n // incidental capability: it is THE mechanism `isAnonymizable` exists to\n // enable. The factory already REQUIRES `UPDATE_MANY` in `coreOperations`\n // above \"for transposition batch update\"; that core operation is\n // unreachable by the transposition service without this system-access\n // opt-in, so deriving it here COMPLETES an existing coupling rather than\n // inventing a new one — and removes a guaranteed per-app footgun (every\n // app marking a resource `isAnonymizable` would otherwise have to remember\n // the grant, and the engine core ships zero anonymizable resources to model\n // it from).\n //\n // Distinct from the `systemAccessPolicy` ⟂ `isSystemResource` separation\n // documented on the policy type: `isSystemResource` is a broad, ACL-\n // orthogonal marker (framework infra does NOT imply an ACL bypass is\n // acceptable), whereas `isAnonymizable` has a single, specific engine\n // behaviour that requires exactly `updateManyAsSystem`. The derived value\n // is materialised into the RESOLVED config below (not hidden in factory\n // control flow), so specs, audits, and `assertSystemAccessAllowed` all see\n // `updateMany: ALLOWED`. Any explicitly-authored `systemAccessPolicy` on an\n // anonymizable resource is preserved for its other verbs; only `updateMany`\n // is forced ALLOWED (a transposition-required resource cannot opt out of\n // its own transposition).\n //\n // FAIL-LOUD (not silent-override): if the author EXPLICITLY declared\n // `updateMany: FORBIDDEN`, that contradicts `isAnonymizable` (the resource\n // asks for transposition yet forbids the only primitive that performs it).\n // Silently flipping it to ALLOWED would erase an explicit security\n // declaration — dishonest. Throw instead. We read the RAW authored policy\n // (`params.systemAccessPolicy`), NOT the destructured value: an unauthored\n // policy is defaulted to all-verbs-FORBIDDEN above, and forcing THAT to\n // ALLOWED is the intended, non-contradictory derive (the common case). Only\n // a hand-written `updateMany: FORBIDDEN` is the contradiction we reject.\n if (params.systemAccessPolicy?.updateMany === ResourceSystemAccessMode.FORBIDDEN) {\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires systemAccessPolicy.updateMany = ALLOWED ` +\n `(anonymous→user transposition rewrites { userId, anonymousUserId } via updateManyAsSystem), but ` +\n `this resource explicitly authored updateMany: FORBIDDEN. A transposition-required resource cannot ` +\n `opt out of its own transposition — remove the explicit FORBIDDEN (the grant is derived automatically) ` +\n `or drop isAnonymizable.`\n );\n }\n effectiveSystemAccessPolicy = {\n ...systemAccessPolicy,\n updateMany: ResourceSystemAccessMode.ALLOWED,\n };\n }\n\n // ========================================\n // retentionPolicy VALIDATION & ENRICHMENT (impersonalization-on-erasure)\n // ========================================\n //\n // Mirror of the isAnonymizable branch above, for the OTHER trusted-write axis:\n // on erasure a retention-governed resource is impersonalized-and-retained\n // (personal fields scrubbed via `updateManyAsSystem`, row KEPT) instead of\n // hard-deleted. Injects the per-record `retentionStatus` marker and derives the\n // system-access grants the capability requires. RESOURCE-level: the per-edge\n // trigger (`onParentDelete.strategy = IMPERSONALIZE_AND_RETAIN`) and per-field scrub\n // (`.impersonalizeWith()`) are declared separately.\n if (retentionPolicy?.mode) {\n // PRESENCE half of the retention operation contract: each required op must be declared at all.\n // The RESOLVABILITY half — that the declared op has a variant the retention primitives can\n // actually dispatch — runs later, once the operation variants are assembled (search\n // `RETENTION_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS`). Deliberately two checks, because they have\n // two different fixes: \"declare the op\" vs \"declare it with a service-resolvable variant\".\n for (const { operation: requiredOperation, why } of RETENTION_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS) {\n if (!coreOperations.includes(requiredOperation as any)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires ${requiredOperation} in coreOperations (${why}).`\n );\n }\n }\n\n // Guard (framework-quality): `retentionStatus` / `impersonalizedAt` are framework-reserved\n // injected names. Zod-4 `.extend()` SILENTLY OVERWRITES a duplicate key, so a resource that\n // already declares one would have its own field clobbered on opt-in — fail loud instead. The\n // same `getZodObjectShape` call also yields a friendly config error if `mainSchema` is not a\n // ZodObject (the marker cannot be injected into a non-object schema).\n // EXPLICIT object check. (Do NOT rely on `getZodObjectShape` throwing — it returns `{}` for a\n // union, so a try/catch around it is dead code and the real failure surfaces later as an\n // undiagnosable `effectiveMainSchema.extend is not a function`.)\n if (!isZodObject(effectiveMainSchema)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires a ZodObject mainSchema (cannot inject the ` +\n `retentionStatus marker into a non-object schema — polymorphic/union mainSchemas are not yet supported).`\n );\n }\n\n const existingShape = getZodObjectShape(effectiveMainSchema);\n for (const reservedField of ['retentionStatus', 'impersonalizedAt'] as const) {\n if (existingShape[reservedField]) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy injects a reserved '${reservedField}' field, but this ` +\n `resource already declares one. Rename that field or drop retentionPolicy (the marker is factory-injected).`\n );\n }\n }\n\n // ========================================\n // IMPERSONALIZE TREATMENT VALIDATION — fail loud at CONFIG BUILD, not on the erasure path.\n // ========================================\n //\n // The impersonalize writer scrubs via `updateManyAsSystem`, whose STRICT update-DTO parse runs\n // over the scrub patch. A treatment the declared field schema cannot accept therefore throws\n // INSIDE the parent-delete transaction and ROLLS BACK the erasure — the worst possible moment to\n // discover a config mistake. Every check below is a pure `safeParse` against the AUTHORED field\n // schema, so it catches every axis at once without a type taxonomy:\n //\n // - REMOVE writes `null`, which the field-clearing contract resolves into either a stored null\n // (null-accepting field) or a removed key (merely `.optional()`). Both are what REMOVE asks\n // for, so the requirement is that the field be CLEARABLE — i.e. not required and not\n // `.default()`-wrapped, since a default's output type is non-optional.\n // HISTORY, because this comment justified a stricter guard for months: update DTOs used to\n // be made `.optional()` and NEVER `.nullable()`, so a non-nullish field really did reject\n // the scrub, and the capability was non-functional for every non-nullable field. That\n // changed when `toPatchOptionalField` began admitting null for clearable fields; the guard\n // below was left demanding `.nullish()` and so failed startup on valid declarations.\n // - MASK writes the field's EFFECTIVE mask value — its own `maskValue` override, or\n // `IMPERSONALIZE_MASK_CONSTANT`. Beyond the obvious number/date/enum/boolean mismatches, the\n // default constant also fails CONSTRAINED strings — `z.email()`, `z.uuid()`, `.min(n)` — i.e.\n // exactly the PII fields most likely to be masked, which is why the override exists. A\n // \"MASK is string-only\" rule would NOT be sufficient. An override is validated against the\n // field's own schema here, and is rejected outright on a non-MASK treatment (nothing would\n // write it).\n // - A resource that opts into retentionPolicy but declares ZERO treatments would flip rows to\n // `RETAINED` with every personal field intact: a compliance-grade lie (it LOOKS erased).\n for (const [fieldName, fieldSchema] of Object.entries(existingShape)) {\n const treatment = getImpersonalizeTreatment(fieldSchema as z.ZodTypeAny);\n if (treatment === undefined) continue;\n\n // Floor fields are never scrubbed, so their schema need not accept a scrub value. Reuse the\n // writer's own floor predicate — one authority, so the guard can never drift from the scrub.\n if (isImpersonalizeNeverScrubFloorField(fieldName)) continue;\n\n // D1 allows SEVERING the person-link (`userId` / `anonymousUserId`) — but only when a NON-person\n // scope survives to anchor the retained row. If the person-link IS the resource's primary scope,\n // nulling it strips the row's only tenant anchor: contextual scoping can no longer reach it, so\n // the retained record becomes invisible even to the audited see-through path that retention\n // exists to serve (retained-but-unreachable ≠ retained).\n const severedScope = FIELD_IDENTIFIER_TO_PRIMARY_SCOPE[fieldName];\n if (\n treatment === RedactionType.REMOVE &&\n severedScope !== undefined &&\n severedScope === resourcePrimaryScope\n ) {\n throw createConfigurationError(\n `[${resourceIdentifier}] field '${fieldName}' declares impersonalize treatment REMOVE, but it is this ` +\n `resource's PRIMARY scope ('${severedScope}'). Severing the primary-scope link would leave the retained ` +\n `row with no tenant anchor — unreachable through contextual scoping, including the audited see-through ` +\n `read. Keep the primary-scope link (use KEEP) and scrub the personal FIELDS instead.`\n );\n }\n\n // NOTE ON UNIQUE-INDEXED FIELDS (gate G-BKEY): a scrub writes the SAME value to every row in\n // the batch (`null` for REMOVE, one shared mask constant for MASK), which on a plain unique\n // index would collide (E11000) and abort the erasure. That is NOT rejected here, because the\n // schema layer scopes every unique index on a retention-governed resource to NON-RETAINED rows\n // (`partialFilterExpression`, see `buildRetentionPartialFilterExpression`): the scrubbed rows\n // become RETAINED in the same write, leave the index, and therefore cannot collide — the same\n // property that stops a retained row from permanently locking out re-creation of its key.\n // ⚠️ This guard's absence DEPENDS on that partial index. If the partial filter is ever removed,\n // a treatment on a unique field becomes an erasure-aborting defect again.\n\n // A maskValue is meaningful ONLY under MASK — no other treatment writes it. Declaring one\n // elsewhere means the author believes a specific value will be stored while the writer would\n // null the field (REMOVE) or leave it untouched (KEEP): the declaration and the behaviour\n // disagree, which is the same class of silent compliance lie the zero-scrub guard prevents.\n // Checked BEFORE the per-treatment branches, and independently of them — as an arm of that\n // if/else chain it would be unreachable for exactly the treatments it needs to reject.\n if (treatment !== RedactionType.MASK && getImpersonalizeMaskValue(fieldSchema as z.ZodTypeAny) !== undefined) {\n throw createConfigurationError(\n `[${resourceIdentifier}] field '${fieldName}' declares an impersonalize maskValue but its treatment is ` +\n `'${treatment}', not MASK — nothing would ever write that value. Use MASK to store it, or drop the maskValue.`\n );\n }\n\n if (treatment === RedactionType.REMOVE) {\n // REMOVE writes `null`, and the field-clearing contract decides what that PERSISTS as: a\n // null-accepting field stores the null, a merely-`.optional()` field has the key removed.\n // Either outcome is what REMOVE asks for, so the requirement is CLEARABILITY, not\n // null-acceptance.\n //\n // This guard used to demand `.nullish()` and justify it with \"update DTOs are made\n // .optional(), never .nullable()\". That was true when it was written and is not any more —\n // `toPatchOptionalField` now admits null for every clearable field. Left unchanged, the\n // guard rejected a perfectly valid `.optional()` + REMOVE declaration at CONFIG BUILD, i.e.\n // it failed application startup, and explained the refusal with a rule that no longer\n // exists.\n if (!mainSchemaFieldIsClearable(fieldSchema as z.ZodTypeAny)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] field '${fieldName}' declares impersonalize treatment REMOVE, which clears the ` +\n `field, but the field is required (or carries a \\`.default()\\`, whose output type is non-optional). A ` +\n `field that must always hold a value cannot be scrubbed by removal — declare it \\`.optional()\\` or ` +\n `\\`.nullish()\\`, or use MASK to overwrite it with a placeholder instead.`\n );\n }\n } else if (treatment === RedactionType.MASK) {\n // Validate the EFFECTIVE value — the field's own `maskValue` override when it declares one,\n // the framework constant otherwise — resolved through the SAME helper the scrub writer uses,\n // so a config that passes here cannot produce a write the update DTO rejects mid-erasure.\n const effectiveMaskValue = resolveImpersonalizeMaskValue(fieldSchema as z.ZodTypeAny);\n if (!(fieldSchema as z.ZodTypeAny).safeParse(effectiveMaskValue).success) {\n throw createConfigurationError(\n effectiveMaskValue === IMPERSONALIZE_MASK_CONSTANT\n ? `[${resourceIdentifier}] field '${fieldName}' declares impersonalize treatment MASK, but its schema ` +\n `rejects the default mask constant '${IMPERSONALIZE_MASK_CONSTANT}'. That constant is an unconstrained ` +\n `string, so a number/date/enum/boolean — or a CONSTRAINED string such as z.email()/z.uuid()/.min(n) — ` +\n `cannot hold it. Either declare a field-specific value the schema accepts ` +\n `(\\`.impersonalizeWith(MASK, { maskValue: '...' })\\`), or use REMOVE on a \\`.nullish()\\` field.`\n : `[${resourceIdentifier}] field '${fieldName}' declares impersonalize treatment MASK with ` +\n `maskValue '${effectiveMaskValue}', but its own schema rejects that value. The mask is written ` +\n `verbatim through the strict update-DTO parse, so it must satisfy every constraint the field ` +\n `declares (format, length, enum membership).`\n );\n }\n } else if (treatment === RedactionType.RESET) {\n /*\n * RESET returns the field to its schema default — the treatment for a field that is non-nullable\n * WITH a `.default()`, where REMOVE (needs clearable) and MASK (needs a string) both refuse.\n *\n * The RULES live in `resolveImpersonalizeResetValue`, deliberately, and are NOT restated here: it\n * refuses a field with no default, and one that is merely `.optional()` (whose default IS\n * undefined, so nothing would be scrubbed). One authority, because a second copy of either check\n * would drift from the writer that actually runs them.\n *\n * What this arm adds is WHERE the failure surfaces. Called here, the refusal is a CONFIGURATION\n * error naming the RESOURCE. Left to fall through, the same resolver still runs — via\n * `buildImpersonalizeScrubPatch` further down this function — but throws a bare Error naming only\n * the field, which boot does not classify as a configuration fault.\n */\n try {\n resolveImpersonalizeResetValue(fieldSchema as z.ZodTypeAny, fieldName);\n } catch (error) {\n throw createConfigurationError(\n `[${resourceIdentifier}] ${error instanceof Error ? error.message : String(error)}`\n );\n }\n }\n }\n\n // Count what the WRITER would actually scrub, not what was merely declared. `KEEP` treatments and\n // treatments on never-scrub floor fields are both skipped by `buildImpersonalizeScrubPatch`, so\n // counting declarations would let a resource satisfy this guard with a patch that is EMPTY — rows\n // flipping to RETAINED with every field intact, which is precisely the compliance lie the guard\n // exists to prevent. Deriving the count from the writer keeps ONE authority for \"what gets scrubbed\".\n // FAIL LOUD on a NESTED treatment. Both the guard above and the writer walk TOP-LEVEL keys only\n // (`getMergedObjectOrUnionShape` merges union options; it does not descend into nested objects, and\n // `getMetadataRecursive` traverses wrappers but never a ZodObject's shape). So a\n // `.impersonalizeWith()` declared on a nested field — `billingContact.email`, or a nested\n // `z_file()` — is SILENTLY IGNORED: the row flips to RETAINED while that field, and any file linked\n // under its dotted path, survive intact. That is the compliance lie this whole block exists to\n // prevent, reached through a door the top-level walk cannot see. Recursive scrubbing is deliberately\n // out of v1 scope, so an unscrubable nested treatment must be a BOOT ERROR rather than a silent skip.\n assertNoNestedImpersonalizeTreatment(effectiveMainSchema, resourceIdentifier);\n\n // The two modes assert OPPOSITE things about this resource's fields, so each fails loud on the\n // other's shape. Neither is a warning: a mismatch here means the config claims something about\n // personal data that the runtime would not honour.\n const effectiveScrubPatch = buildImpersonalizeScrubPatch(effectiveMainSchema);\n if (retentionPolicy.mode === ErasureRetentionMode.RETAIN_ONLY) {\n // RETAIN_ONLY asserts \"this resource holds no personal data of its own\". A treatment contradicts\n // that claim — and would be silently ignored at erasure time, since RETAIN_ONLY writes only the\n // markers. Fail rather than let the declaration and the behaviour disagree.\n if (Object.keys(effectiveScrubPatch).length > 0) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy.mode = RETAIN_ONLY asserts this resource holds no personal data of ` +\n `its own, but field(s) [${Object.keys(effectiveScrubPatch).join(', ')}] declare an impersonalize treatment. ` +\n `Those treatments would never run. Use mode = RETAIN_AND_IMPERSONALIZE to actually scrub them, or remove them.`\n );\n }\n /*\n * The SECOND direction, and until 2026-08-31 it did not exist.\n *\n * The check above sees a field with a TREATMENT. This one sees a field DECLARED as personal data\n * and given no treatment — which is the shape a wrong `RETAIN_ONLY` actually takes. Without it,\n * the cheap mode was also the one that failed silently: a resource whose fields carry\n * `.dataCategories()` could assert it holds no personal data, pass every gate, and put that\n * assertion into a governed document. `RETAIN_AND_IMPERSONALIZE` never had the hole — it is\n * refused when nothing would be scrubbed.\n *\n * This catches a CONTRADICTION, not an omission. A resource that classified nothing still passes,\n * because \"nobody declared a category\" and \"there is no personal data\" are indistinguishable\n * here; that is the category inventory's question. A clean result is not a proof.\n */\n const declaredPersonalDataFields = collectDeclaredPersonalDataFields(effectiveMainSchema);\n if (declaredPersonalDataFields.length > 0) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy.mode = RETAIN_ONLY asserts this resource holds no personal data of ` +\n `its own, but field(s) [${declaredPersonalDataFields.join(', ')}] declare .dataCategories(). The resource ` +\n `cannot both hold personal data and hold none. Use mode = RETAIN_AND_IMPERSONALIZE and give those fields an ` +\n `impersonalize treatment, or — if the category is wrong — correct the field. Scope foreign keys and ` +\n `createdByUserId are excluded here: they link a row to a person without being personal data the row holds.`\n );\n }\n } else if (Object.keys(effectiveScrubPatch).length === 0) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy.mode = RETAIN_AND_IMPERSONALIZE but NO field would actually be ` +\n `scrubbed (KEEP treatments and treatments on never-scrub floor fields such as scope FKs / createdByUserId ` +\n `do not count). Erasure would flip rows to RETAINED with every personal field intact — a record ` +\n `that looks scrubbed but is not. Mark at least one non-floor personal field REMOVE or MASK, or — if this ` +\n `resource genuinely holds no personal data of its own — declare mode = RETAIN_ONLY instead.`\n );\n }\n\n // Inject the per-record retention marker. Server-managed (excluded from client\n // create/update, hidden), DB-indexed for the hidden-by-default filter predicate\n // + the future disposal clock. Defaults to ACTIVE; only the impersonalize writer\n // flips it to RETAINED via updateManyAsSystem (which re-attaches verb-excluded\n // fields after the strict parse — see deriveTrustedSystemWritePreservedFields).\n effectiveMainSchema = (effectiveMainSchema as any).extend({\n retentionStatus: RetentionStatusSchema\n .default(RetentionStatus.ACTIVE)\n .isDBIndexed()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isHidden(),\n impersonalizedAt: z.date()\n .optional()\n .isDBIndexed()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isHidden(),\n }) as TMainSchema;\n\n // Derive the impersonalization system-access grants (parallel to the\n // isAnonymizable updateMany derive above): `updateMany` for the in-place scrub,\n // `seeRetained` for the audited see-through read of retained rows. FAIL-LOUD, not\n // silent-override: if the author EXPLICITLY declared either verb FORBIDDEN, that\n // contradicts retentionPolicy (the resource asks to be retained-and-scrubbed yet\n // forbids the only primitive that performs / audits it). We read the RAW authored\n // policy (`params.systemAccessPolicy`) — an unauthored policy defaults to\n // all-verbs-FORBIDDEN, and deriving THAT to ALLOWED is the intended common case.\n if (params.systemAccessPolicy?.updateMany === ResourceSystemAccessMode.FORBIDDEN) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires systemAccessPolicy.updateMany = ALLOWED ` +\n `(the impersonalize writer scrubs in place via updateManyAsSystem), but this resource explicitly ` +\n `authored updateMany: FORBIDDEN. Remove it (the grant is derived automatically) or drop retentionPolicy.`\n );\n }\n if (params.systemAccessPolicy?.seeRetained === ResourceSystemAccessMode.FORBIDDEN) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires systemAccessPolicy.seeRetained = ALLOWED ` +\n `(the audited see-through read of retained rows), but this resource explicitly authored ` +\n `seeRetained: FORBIDDEN. Remove it (the grant is derived automatically) or drop retentionPolicy.`\n );\n }\n effectiveSystemAccessPolicy = {\n ...effectiveSystemAccessPolicy,\n updateMany: ResourceSystemAccessMode.ALLOWED,\n seeRetained: ResourceSystemAccessMode.ALLOWED,\n };\n }\n\n // ── dataSubjectPolicy: WHO the row is, and whose session an erasure ends ──────────────────────\n //\n // Placed AFTER the retention operation contract on purpose: a config can be wrong in several ways\n // at once, and the contract's errors are the more specific ones (\"declare UPDATE_MANY\", \"rename\n // your reserved field\"). Running this first masked them, so an author fixing a missing operation\n // was told to declare a data-subject policy instead.\n //\n // Paired with `retentionPolicy` in BOTH directions, because a retention-governed resource is\n // exactly one that `eraseSubjectAsSystem` accepts as a subject (the orchestrator refuses a subject\n // with no retention policy), and a `dataSubjectPolicy` on anything else describes an erasure that\n // can never happen.\n //\n // Undeclared is REFUSED rather than defaulted: there is no safe default. Assuming\n // NO_PRINCIPAL would silently drop a real person's session revocation; assuming a linked\n // principal would revoke whoever a user foreign key happens to name — on `TODOS` that is the\n // author, the assignee and the escalation contact, none of whom is the data subject. Refusing is\n // what forces the decision, matching the subject-EXPORT model's treatment of an undeclared resource.\n if (retentionPolicy?.mode && !dataSubjectPolicy) {\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires a dataSubjectPolicy. A retention-governed ` +\n `resource can be passed to eraseSubjectAsSystem as a data subject, so it must declare WHOSE ` +\n `SESSION an erasure ends: ResourceDataSubjectKind.NO_PRINCIPAL (nobody's — either an ordinary ` +\n `record whose user foreign keys name actors rather than the subject, OR a person with no ` +\n `account such as a CRM contact or a lead), SELF_PRINCIPAL (the row is the person and its own ` +\n `id is the session principal), or LINKED_PRINCIPAL with sessionPrincipalField (the person ` +\n `signs in as a different USERS row). Note this is NOT \"is the row about a person\" — that is ` +\n `answered by retentionPolicy.mode. This is never inferred from a user foreign key — doing so ` +\n `would revoke the sessions of owners and assignees instead of the subject.`\n );\n }\n if (dataSubjectPolicy && !retentionPolicy?.mode) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy requires retentionPolicy. Without one this resource ` +\n `can never be an erasure subject (eraseSubjectAsSystem refuses a subject that is not ` +\n `retention-governed), so the declaration would describe an erasure that cannot happen.`\n );\n }\n if (dataSubjectPolicy) {\n const namesPrincipalField = dataSubjectPolicy.kind === ResourceDataSubjectKind.LINKED_PRINCIPAL;\n if (namesPrincipalField && !dataSubjectPolicy.sessionPrincipalField) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy.kind = LINKED_PRINCIPAL requires ` +\n `sessionPrincipalField — the field naming the USERS row whose session an erasure of this row ` +\n `must end. Without it the erasure has no principal to revoke and the declaration would be inert.`\n );\n }\n if (!namesPrincipalField && dataSubjectPolicy.sessionPrincipalField) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy.sessionPrincipalField is only valid under ` +\n `kind = LINKED_PRINCIPAL (got '${dataSubjectPolicy.kind}'). Under SELF_PRINCIPAL the row's own ` +\n `id IS the principal, and under NO_PRINCIPAL there is no principal at all — so naming a ` +\n `field here is a contradiction, not a redundancy.`\n );\n }\n // The named link must not ALSO be scrubbed. This is a COHERENCE guard, not a prerequisite of the\n // revocation: the principal is resolved BEFORE the scrub (a post-commit read is impossible — the\n // row is RETAINED and hidden by then, and the only see-through door demands a privileged human),\n // so a scrubbed field would still be readable when it matters. It is refused because declaring one\n // field to be BOTH the link to a person and personal data to destroy is a contradiction, and it\n // leaves the retained row unable to say whose session was ended.\n //\n // Derived from the WRITER (`buildImpersonalizeScrubPatch`) rather than from a treatment count —\n // the same discipline the zero-scrub guard uses, because only the writer knows which declarations\n // actually produce a scrub.\n if (namesPrincipalField && mainSchema instanceof z.ZodObject) {\n const principalField = dataSubjectPolicy.sessionPrincipalField as string;\n if (!(principalField in (mainSchema.shape as Record<string, unknown>))) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy.sessionPrincipalField = '${principalField}' is not ` +\n `a top-level field of this resource's mainSchema.`\n );\n }\n if (principalField in buildImpersonalizeScrubPatch(mainSchema)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy.sessionPrincipalField = '${principalField}' is ` +\n `SCRUBBED by the erasure (it carries an .impersonalizeWith() treatment the writer acts on). A ` +\n `field cannot be both the link naming this person's login and personal data to destroy — the ` +\n `retained row would be left unable to say whose session was ended. Remove the treatment from ` +\n `that field (a user id is a link, not personal data of this row) or name a different field.`\n );\n }\n }\n\n // The system LIST grant the principal lookup needs.\n //\n // `eraseSubjectAsSystem` resolves the principal by reading the subject rows through\n // `listAsSystem`, which fail-closes on `systemAccessPolicy.list`. The retention derivation grants\n // only `updateMany` + `seeRetained`, and an unauthored policy is all-verbs-FORBIDDEN — so without\n // this the lookup would throw, be swallowed as best-effort, resolve to NO principals, and the\n // erased person's session would quietly survive. That is the exact failure this whole capability\n // exists to close, so the grant is derived from the declaration that requires it.\n //\n // Reads the RAW authored policy (`params.systemAccessPolicy`) — an unauthored policy defaults to\n // all-verbs-FORBIDDEN, and deriving THAT to ALLOWED is the intended common case.\n //\n // Scoped to LINKED_PRINCIPAL deliberately: SELF_PRINCIPAL needs no read (the subject ids ARE the\n // user ids) and NO_PRINCIPAL reads nothing at all, so neither earns a widened system surface.\n if (namesPrincipalField) {\n if (params.systemAccessPolicy?.list === ResourceSystemAccessMode.FORBIDDEN) {\n throw createConfigurationError(\n `[${resourceIdentifier}] dataSubjectPolicy.kind = LINKED_PRINCIPAL requires ` +\n `systemAccessPolicy.list = ALLOWED (the erasure reads the subject rows to resolve the session ` +\n `principal), but this resource explicitly authored list: FORBIDDEN. Remove it (the grant is ` +\n `derived automatically) or declare a different dataSubjectPolicy.kind.`\n );\n }\n effectiveSystemAccessPolicy = {\n ...effectiveSystemAccessPolicy,\n list: ResourceSystemAccessMode.ALLOWED,\n };\n }\n }\n\n // ========================================\n // DATA-CATEGORY VOCABULARY VALIDATION\n // ========================================\n //\n // `.dataCategories()` stores opaque strings: `zod-decorators` sits BELOW this package and cannot\n // import `PersonalDataCategory`, so its chokepoint can only check that non-empty strings were\n // declared. This is the layer that owns the enum, so this is where membership is checked.\n //\n // UNCONDITIONAL, unlike the impersonalize guards above — those run only inside `retentionPolicy`\n // because a treatment is meaningless without one. A data category is meaningful on any resource:\n // a hard-deleted resource still HOLDS personal data while it exists, and a privacy notice must\n // enumerate it. Gating this on retentionPolicy would silently exempt exactly the resources that\n // opted out of retention.\n //\n // A typo'd category is worse than an undeclared one and that is why this is a BOOT ERROR rather\n // than a warning: `'contact_details'` (underscore) is not a member, so the field would be counted\n // as CATEGORIZED by the gap report — it carries a declaration — while contributing nothing to the\n // notice's category list. The field disappears from the inventory while looking annotated in the\n // schema, which is the failure this whole capability exists to prevent.\n //\n // TOP-LEVEL fields only, deliberately matching `resolveResourcePersonalDataCategories`: a nested\n // declaration is invisible to the reader, so validating it here would certify a value nothing\n // consumes. Unlike a nested `.impersonalizeWith()` — which is a boot error because the row would\n // flip to RETAINED with the field intact — a nested category breaks nothing at runtime; it simply\n // never reaches a notice.\n if (isZodObject(effectiveMainSchema)) {\n for (const [fieldName, fieldSchema] of Object.entries(getZodObjectShape(effectiveMainSchema))) {\n const declared = getDataCategories(fieldSchema as z.ZodTypeAny);\n if (declared === undefined) continue;\n const unknownCategories = unknownPersonalDataCategories(declared);\n if (unknownCategories.length > 0) {\n throw createConfigurationError(\n `[${resourceIdentifier}] field '${fieldName}' declares data categor${unknownCategories.length === 1 ? 'y' : 'ies'} ` +\n `[${unknownCategories.join(', ')}] that ${unknownCategories.length === 1 ? 'is' : 'are'} not a PersonalDataCategory member. ` +\n `A value outside the vocabulary counts the field as CATEGORIZED — so it is excluded from the ` +\n `uncategorized-field gap report — while contributing nothing to the privacy notice's category list. ` +\n `Use a PersonalDataCategory member, or drop the declaration if the field holds no personal data.`\n );\n }\n }\n }\n\n // ========================================\n // TRANSFORM RESOURCE RELATIONSHIPS\n // ========================================\n\n const { processedResourceRelationships, availableParentResourceTypes } = transformResourceRelationships(effectiveResourceRelationships, resourceIdentifier);\n\n // ========================================\n // DERIVE SUMMARY SCHEMA FROM isSummaryField DECORATORS\n // ========================================\n\n // Auto-derive summary schema for LIST/SEARCH operations from isSummaryField decorators\n // This replaces manual responseSummaryDto definitions\n // Must be computed BEFORE operations loop so LIST operations can use it\n const derivedSummarySchema = inheritenceSchemaDefinition\n ? ResourcesSummaryUtils.deriveSummarySchemaForDiscriminatedUnion(\n effectiveMainSchema as unknown as z.ZodObject<z.ZodRawShape>,\n inheritenceSchemaDefinition as unknown as ResourceConfiguration_InheritanceSchemaDefinition<any, z.ZodObject<z.ZodRawShape>>\n )\n : ResourcesSummaryUtils.deriveSummarySchema(effectiveMainSchema);\n\n // ========================================\n // FLATTEN OPERATIONS AND SEARCHABLE CONFIGURATIONS\n // ========================================\n\n const operations: ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>[] = [];\n\n // Extract autoVariants config (default all true)\n const autoVariants = params.autoVariants || {};\n const autoVariantsRead = autoVariants.read || {};\n const autoVariantsList = autoVariants.list || {};\n const enableReadSummary = autoVariantsRead.enableSummary !== false; // default true\n const enableReadContext = autoVariantsRead.enableContext !== false; // default true\n const enableListSummary = autoVariantsList.enableSummary !== false; // default true\n const enableListContext = autoVariantsList.enableContext !== false; // default true\n\n // Process operation configurations\n for (const [operation, config] of Object.entries(operationsConfiguration) as [ValidOperationKeys<TCustomOperationEnum, TCoreOperationEnum>, ResourceConfiguration_Operation_BuilderParameters<TMainSchema>][]) {\n assertOperationPathKeySegment(String(operation), 'operation identifier', String(operation));\n\n // Validate isDefault logic by grouping variants by their variantType\n const variantsByType = new Map<ResourceOperationVariantType, ResourceConfiguration_OperationVariant_BuilderParameters<TMainSchema>[]>();\n\n // Group variants by their type\n config.variants.forEach(variant => {\n if (!variantsByType.has(variant.variantType)) {\n variantsByType.set(variant.variantType, []);\n }\n variantsByType.get(variant.variantType)!.push(variant);\n });\n\n // Validate each variant type group. URL-bearing variants form a shared\n // operation identity space (`API_CALL` and `API_CALL_WITH_CALLBACK` are\n // both selected by operation/default/key at many call sites), so their\n // default/key invariants are validated as one combined group below.\n for (const [variantType, variantsGroup] of variantsByType.entries()) {\n if (!isUrlisableOperationVariantType(variantType) && variantsGroup.length > 1) {\n const explicitDefaults = variantsGroup.filter((variant) =>\n variant.isDefault === true\n );\n if (explicitDefaults.length === 0) {\n throw createConfigurationError(`Operation '${operation}' with multiple ${variantType} variants must have at least one with isDefault=true`);\n }\n if (explicitDefaults.length > 1) {\n throw createConfigurationError(`Operation '${operation}' with multiple ${variantType} variants cannot declare more than one with isDefault=true`);\n }\n }\n\n if (isUrlisableOperationVariantType(variantType)) {\n for (const variant of variantsGroup) {\n // 🔒 Fail-closed guard: a URL-bearing variant with an EMPTY roles array\n // is not \"skip the role check\" — it is a guaranteed 403. The runtime gate\n // (`AuthorizationsBackendService.validateOperationRoles`) evaluates\n // `roles.some(...)`, and `[].some()` is always false, so EVERY caller is\n // denied. There is no legitimate empty-roles URL operation: public ops use\n // `APP_PUBLIC`, anonymous ops use `APP_ANONYMOUS`, user-self ops use\n // `APP_USER` (row ownership is enforced separately by the scope authorizer).\n // Catch the mistake at config-build time instead of shipping a dead endpoint.\n // (INTERNAL_CALL / REPOSITORY_ONLY variants are exempt — not URL-bearing, so\n // this loop never sees them; their empty roles are inert.)\n if (!variant.roles || variant.roles.length === 0) {\n throw createConfigurationError(\n `Operation '${operation}' has a URL-bearing (${variantType}) variant with an empty roles array. ` +\n `An empty roles array is fail-CLOSED: the authorization gate evaluates roles.some(...), which is ` +\n `always false for [], so every caller is denied (403). Specify at least one role — e.g. ` +\n `CORE_APP_ROLES.APP_USER (user-self / any authenticated user), CORE_APP_ROLES.APP_PUBLIC (public), ` +\n `CORE_APP_ROLES.APP_ANONYMOUS (anonymous), or the appropriate ORG/APP role.`,\n );\n }\n if (variant.variantKey) {\n assertOperationPathKeySegment(variant.variantKey, 'variantKey', String(operation));\n }\n if (variant.variantKey && RESERVED_OPERATION_VARIANT_KEYS.has(variant.variantKey.toLowerCase())) {\n throw createConfigurationError(\n `Operation '${operation}' cannot use reserved variantKey '${variant.variantKey}'`,\n );\n }\n if (variant.variantKey && AUTO_OPERATION_VARIANT_KEYS.has(variant.variantKey.toLowerCase() as typeof OPERATION_VARIANT_KEY.SUMMARY | typeof OPERATION_VARIANT_KEY.CONTEXT)\n && variant.variantKey !== variant.variantKey.toLowerCase()\n ) {\n throw createConfigurationError(\n `Operation '${operation}' must use canonical lowercase variantKey '${variant.variantKey.toLowerCase()}' for generated variant semantics`,\n );\n }\n if (variant.variantKey && AUTO_OPERATION_VARIANT_KEYS.has(variant.variantKey.toLowerCase() as typeof OPERATION_VARIANT_KEY.SUMMARY | typeof OPERATION_VARIANT_KEY.CONTEXT)\n && !isDataModeVariantKeyAllowedForOperation(String(operation), variant)\n ) {\n throw createConfigurationError(\n `Operation '${operation}' cannot use data-mode variantKey '${variant.variantKey}' unless it is READ, LIST, or SEARCH-like`,\n );\n }\n }\n }\n }\n\n const urlisableVariants = config.variants.filter((variant) => isUrlisableOperationVariantType(variant.variantType));\n const explicitUrlisableDefaults = urlisableVariants.filter((variant) => variant.isDefault === true);\n if (urlisableVariants.length > 1) {\n if (explicitUrlisableDefaults.length === 0) {\n throw createConfigurationError(\n `Operation '${operation}' with multiple URL-bearing variants must have exactly one with isDefault=true`,\n );\n }\n if (explicitUrlisableDefaults.length > 1) {\n throw createConfigurationError(\n `Operation '${operation}' cannot declare more than one default URL-bearing variant across API_CALL and API_CALL_WITH_CALLBACK`,\n );\n }\n }\n // A single URL-bearing variant is the URL default UNLESS the author explicitly set\n // `isDefault: false` — mirrors `determineOperationVariantDefault` Rule 1 so the stored\n // `isOperationDefault` flag and this validation set never disagree. When the opt-out is\n // honored, the sole `isDefault: false` URL variant is treated as non-default here, which\n // correctly routes it through the \"non-default URL-bearing variant must declare a\n // variantKey\" check below — a sole opted-out URL variant with no variantKey would\n // otherwise be unresolvable by BOTH the default and the keyed path resolver.\n const urlisableDefaultVariants = urlisableVariants.length === 1\n ? urlisableVariants.filter((variant) => variant.isDefault !== false)\n : explicitUrlisableDefaults;\n\n const urlisableVariantKeys = new Set<string>();\n for (const variant of urlisableVariants) {\n const willBeDefault = urlisableDefaultVariants.includes(variant);\n\n if (variant.variantKey) {\n const normalizedVariantKey = variant.variantKey.toLowerCase();\n if (urlisableVariantKeys.has(normalizedVariantKey)) {\n throw createConfigurationError(\n `Operation '${operation}' cannot reuse variantKey '${variant.variantKey}' across URL-bearing variants`,\n );\n }\n urlisableVariantKeys.add(normalizedVariantKey);\n }\n\n if (willBeDefault) {\n continue;\n }\n\n if (!variant.variantKey) {\n throw createConfigurationError(\n `Operation '${operation}' cannot declare a non-default URL-bearing variant without a variantKey`,\n );\n }\n\n }\n\n // Process parent resource access scope strategy overrides for this operation\n const operationResourceRelationships = processParentResourceAccessScopeStrategyOverrides(\n processedResourceRelationships,\n availableParentResourceTypes,\n config.parentResourceAccessScopeStrategyOverrides || [],\n operation as string\n );\n\n // Process user notifications using helper function\n const userNotifications = processUserNotifications(\n config.userNotifications || [],\n resourceIdentifier,\n operation,\n resourcePrimaryScope\n );\n\n // Process m2mNotifications using helper function\n const m2mNotifications = processM2MNotifications(\n config.m2mNotifications || [],\n resourceIdentifier,\n operation\n );\n\n // Process each variant to create flattened operations\n config.variants.forEach((variantParams, variantIndex) => {\n // Note: Cascading delete is now handled via childOperations.lifecycle.onParentDelete on relationships\n // No longer processed at operation variant level\n\n // Determine if this variant is the operation default. URL-bearing\n // variants share one default/key identity space across API and callback\n // transports; non-URL transports keep variant-type-local defaults.\n const variantsOfSameType = variantsByType.get(variantParams.variantType) || [];\n const isOperationDefault = isUrlisableOperationVariantType(variantParams.variantType)\n ? determineOperationVariantDefault(urlisableVariants, variantParams)\n : determineOperationVariantDefault(variantsOfSameType, variantParams);\n\n // Determine effective operation for DTO derivation\n // For custom operations, use resourceOperationLike if it maps to CREATE or UPDATE\n const isCustomOperation = !coreOperations.includes(operation as any);\n const effectiveOperationForDto = isCustomOperation\n ? (variantParams.resourceOperationLike || operation)\n : operation;\n\n // ── Dev-time guardrail: custom op borrowing a NON-object envelope verb ──\n // A custom operation that borrows DELETE / DELETE_MANY / COUNT via\n // `resourceOperationLike` inherits that verb's DEFAULT response envelope\n // (`{ id, deletedAt? }` / `{ deletedIds, deletedCount }` / `{ count }`) as\n // its responseDto AND internalDto. That envelope is almost never what a\n // custom op actually returns, so at runtime the service output fails\n // `transformOutput`'s `internalDto.parse` → HTTP 500\n // (`service_resource_transformation_failed`). Warn — do NOT throw: a custom\n // op that legitimately returns a bare id / `{ count }` is valid, so this is\n // a misconfiguration signal, not an invariant. Surfacing it at registry\n // build beats discovering it on first invocation.\n //\n // Scope note: this deliberately does NOT cover UPDATE / CREATE / READ\n // borrowing. Those verbs' default response IS the resource object, which is\n // correct for the many custom mutation ops that return the mutated entity —\n // a static check cannot tell those from the (rarer) ones that return a\n // non-resource shape (e.g. `{ url }`, `{ message }`). Those are guarded by\n // an authored `customResponseDto` + the built-operation DTO tests instead.\n if (isCustomOperation && !(variantParams as { customResponseDto?: unknown }).customResponseDto\n && (\n variantParams.resourceOperationLike === CoreResourceOperation.DELETE\n || variantParams.resourceOperationLike === CoreResourceOperation.DELETE_MANY\n || variantParams.resourceOperationLike === CoreResourceOperation.COUNT\n )\n ) {\n console.warn(\n `[wildo:resource-config] Custom operation \"${String(resourceIdentifier)}.${String(operation)}\" `\n + `borrows ${String(variantParams.resourceOperationLike)} via resourceOperationLike but declares no `\n + `customResponseDto. It will inherit that verb's default response envelope, which almost never `\n + `matches a custom operation's output and will fail output validation (HTTP 500) at invocation. `\n + `Declare a customResponseDto matching the operation's true return shape.`,\n );\n }\n\n // Auto-derive requestDto from decorators if not explicitly provided\n const derivedRequestDto = deriveRequestDto(\n effectiveOperationForDto as string,\n effectiveMainSchema,\n variantParams.requestDto\n );\n\n // Auto-derive responseDto based on operation type\n // - LIST: use derivedSummarySchema (only isSummaryField fields)\n // - READ/CREATE/UPDATE: use effectiveMainSchema (full object)\n // - DELETE: returns just the deleted ID (handled elsewhere)\n // - customResponseDto overrides if provided\n const deriveResponseDto = (): z.ZodTypeAny => {\n if ((variantParams as any).customResponseDto) {\n return (variantParams as any).customResponseDto;\n }\n if (operation === CoreResourceOperation.LIST\n || (variantParams as any).resourceOperationLike === CoreResourceOperation.LIST) {\n return derivedSummarySchema;\n }\n if (operation === CoreResourceOperation.SEARCH\n || (variantParams as any).resourceOperationLike === CoreResourceOperation.SEARCH) {\n return derivedSummarySchema;\n }\n return effectiveMainSchema;\n };\n\n // Derive the responseDto for this operation (temporary, will be replaced by buildAllOperationDtos)\n const operationResponseDto = deriveResponseDto();\n\n // Create base operation fields shared by all operation types\n // Note: DTOs (requestDto, responseDto, summaryDto, contextDto, internalDto, repositoryDto)\n // will be pre-computed by buildAllOperationDtos() after all operations are created.\n // We set temporary DTOs here for type compatibility, but they will be replaced.\n const baseOperationFields = {\n isDisabled: params.isDisabled ?? false,\n mainSchema: effectiveMainSchema,\n resourcePrimaryScope,\n resourceIdentifier,\n resourceFieldIdentifier,\n resourceRelationships: operationResourceRelationships,\n isSystemResource,\n operationIdentifier: operation,\n isOperationDefault,\n serviceRuntimeMode: config.serviceRuntimeMode || ResourceOperation_ServiceRuntimeMode.INLINE,\n requestDto: derivedRequestDto, // Temporary - will be replaced by buildAllOperationDtos\n responseDto: operationResponseDto, // Temporary - will be replaced by buildAllOperationDtos\n // When the variant supplied an explicit `requestDto`, it is an author-owned\n // contract the DTO builder must preserve verbatim. Otherwise `derivedRequestDto`\n // is an auto-derived TEMPORARY placeholder built from the base object (before\n // inheritance is known), so the builder must rebuild it — as a per-variant union\n // for inheritance resources. See `hasCustomRequestDto` in the operation schema.\n hasCustomRequestDto: !!(variantParams as any).requestDto,\n hasCustomResponseDto: !!(variantParams as any).customResponseDto,\n notificationBadgeOperations: config.notificationBadgeOperations || [],\n userNotifications,\n m2mNotifications,\n // Carried verbatim rather than normalized: it is one authored object with no derived\n // parts, unlike the notification families above, which the factory stamps with scope and\n // identifier. `undefined` means the operation consumes no metered product.\n recordsUsage: config.recordsUsage,\n // Fields from ResourceConfiguration_OperationVariant_Base\n variantType: variantParams.variantType,\n resourceOperationLike: variantParams.resourceOperationLike,\n generatedOperation: variantParams.generatedOperation,\n // Forwarded here rather than inside the collection-view enrichment below, which is an\n // explicit ALLOW-LIST reached only by LIST/SEARCH-shaped variants. Copying it there would\n // make a `collectionExport` declared on the wrong verb vanish silently; copying it here\n // lets it reach `createGeneratedCollectionExportOperations`, which refuses it by name.\n collectionExport: (variantParams as any).collectionExport,\n requiredFeatures: normalizeRequiredFeatures(variantParams.requiredFeatures),\n riskLevel: variantParams.riskLevel || ResourceOperationRiskLevel.LOW,\n // Forwarded for the same reason as the flags below: the frontend resources client reads it\n // off the RUNTIME operation, so dropping it here would leave a declared long-run timeout\n // silently unapplied and the 30s default cutting the request (issue #237).\n clientRequestTimeoutMs: variantParams.clientRequestTimeoutMs,\n roles: variantParams.roles,\n // Forwarded, not defaulted: the startup guard and the request-time refusal both read it\n // off the RUNTIME operation. This block re-lists variant fields rather than spreading\n // them, so a new variant field that is not added here is silently dropped between\n // authoring and runtime.\n unimplementedAcknowledgement: variantParams.unimplementedAcknowledgement,\n // Forwarded for the same reason: `enforceStepUpAuth` reads it off the RUNTIME operation, so\n // an unforwarded flag would leave the authored requirement silently unenforced — the exact\n // failure mode the flag exists to prevent.\n requiresStepUpAuthentication: variantParams.requiresStepUpAuthentication,\n admitsCrossTenantPlatformAdministration: variantParams.admitsCrossTenantPlatformAdministration,\n // Same forwarding obligation as its cross-tenant sibling: the authorizer reads this off the\n // RUNTIME operation, so dropping it here would silently re-close the admin surface.\n admitsCrossSubjectUserAdministration: variantParams.admitsCrossSubjectUserAdministration,\n // Forwarded for the same reason again: the post-commit audit emission reads it off the\n // RUNTIME operation. Dropping it would either lose an authored below-floor opt-in (a silent\n // audit gap) or lose an authored suppression (a duplicate row next to a purpose-built event).\n auditableEvent: variantParams.auditableEvent,\n mcp: variantParams.mcp,\n customServiceImplementationModes: variantParams.customServiceImplementationModes || [],\n basicPrefixOperation: variantParams.basicPrefixOperation,\n // Travels WITH `basicPrefixOperation` — it declares which of that hook's fields survive the\n // repository's strict re-parse even when the caller also sent them. Dropping it here would\n // silently reduce the hook to the added-key inference it exists to correct.\n authoritativeFields: variantParams.authoritativeFields,\n // Forwarded for the same reason as its siblings above: the write-integrity guard reads the\n // per-variant reference POLICY off the RUNTIME operation. Dropping it here degrades every\n // variant to the relationship's baseline membership — so an authored `qualifyingStatuses` /\n // `requiredRoles` / `false` would be silently inert while the config claims otherwise. (This\n // is not hypothetical: it shipped that way once, and the e2e caught it as a PENDING and a\n // REVOKED partnership both admitting a share.)\n referenceConstraints: variantParams.referenceConstraints,\n };\n\n\n\n if (isUrlisableOperationVariantType(variantParams.variantType)) {\n const apiCallParams = variantParams as ResourceConfiguration_OperationVariant_BuilderParameters<TMainSchema> & {\n variantType: ResourceOperationVariantType.API_CALL | ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n };\n const isCallbackVariant = apiCallParams.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK;\n const callbackParams = apiCallParams as {\n callbackUrl?: string;\n callbackTimeout?: number;\n callbackRetryAttempts?: number;\n };\n\n // Determine if this is a custom operation and get the operation to check\n const isCustomOperation = !coreOperations.includes(operation as any);\n const operationToCheck = isCustomOperation ? apiCallParams.resourceOperationLike : operation;\n\n // Validate bulk operation business rules - check against the relevant operation\n const haveBulkOperation = apiCallParams.haveBulkOperation || false;\n if (haveBulkOperation && (operationToCheck === CoreResourceOperation.READ || operationToCheck === CoreResourceOperation.LIST)) {\n throw createConfigurationError(`Operation '${operation}' cannot have bulk operations (read and list are not bulkable)`);\n }\n const tokenStateSideEffects = [\n ...(apiCallParams.tokenGeneration ? ['tokenGeneration'] : []),\n ...(apiCallParams.tokenRevocation ? ['tokenRevocation'] : []),\n ];\n if (\n tokenStateSideEffects.length > 0\n && (\n haveBulkOperation\n || isTokenStateEffectUnsupportedOperation(operationToCheck)\n )\n ) {\n throw createConfigurationError(\n `Operation '${operation}' cannot combine collection/bulk result semantics with ${tokenStateSideEffects.join(' and ')}. `\n + 'Token generation and revocation each require one canonical related resource state; collection, aggregate, and '\n + 'bulk operations do not expose a single related resource identity. Split the token side effect into a singular '\n + 'operation or remove the collection/bulk variant.',\n );\n }\n if (apiCallParams.tokenRevocation && operationToCheck === CoreResourceOperation.CREATE\n ) {\n throw createConfigurationError(\n `Operation '${operation}' cannot revoke tokens before a CREATE operation because no current resource state exists. `\n + 'Move token revocation to an operation that addresses an existing resource.',\n );\n }\n\n // Determine HTTP verb - for custom operations, use resourceOperationLike\n let httpVerb: HttpMethod;\n if (isCustomOperation) {\n // For custom operations, resourceOperationLike is mandatory and we use its HTTP verb\n if (!apiCallParams.resourceOperationLike) {\n throw createConfigurationError(`Operation '${operation}' is a custom operation and must specify resourceOperationLike`);\n }\n httpVerb = getDefaultHttpVerbForOperation(apiCallParams.resourceOperationLike);\n } else {\n // For core operations, use the operation itself\n httpVerb = getDefaultHttpVerbForOperation(operation);\n }\n\n\n\n // ── Build-time validation for token configs ──\n if (apiCallParams.tokenGeneration) {\n validateTokenGenerationConfig(\n apiCallParams.tokenGeneration,\n resourceIdentifier as string,\n operation as string,\n );\n }\n if (apiCallParams.tokenRevocation) {\n validateTokenRevocationConfig(\n apiCallParams.tokenRevocation,\n resourceIdentifier as string,\n operation as string,\n );\n }\n\n const apiCallOperationFields = {\n ...baseOperationFields,\n httpVerb,\n isApiKeyAccessDisabled: apiCallParams.isApiKeyAccessDisabled || false,\n isBulkOperation: false, // Normal operation\n tokenAuthentication: apiCallParams.tokenAuthentication,\n tokenGeneration: apiCallParams.tokenGeneration,\n tokenRevocation: apiCallParams.tokenRevocation,\n // Per-endpoint rate-limit policy: forwarded from the\n // builder params to the resolved operation. Read at runtime by\n // `RateLimitBackendService.checkPolicyForVariant` at the controller\n // pre-flight seam. `undefined` means the global HTTP limiter is the\n // only gate for this route.\n rateLimit: apiCallParams.rateLimit,\n enabledCondition: apiCallParams.enabledCondition,\n isDefault: apiCallParams.isDefault,\n variantKey: apiCallParams.variantKey,\n ...(isCallbackVariant ? {\n callbackUrl: callbackParams.callbackUrl,\n callbackTimeout: callbackParams.callbackTimeout ?? 300,\n callbackRetryAttempts: callbackParams.callbackRetryAttempts ?? 3,\n } : {}),\n };\n\n // ── Collection-view enrichment ──────────────────────────────────\n // When an operation is SEARCH-like or LIST-like (by identity or resourceOperationLike),\n // extract collection-view fields from the variant params and compute derived schemas.\n const isSearchLike = operation === CoreResourceOperation.SEARCH\n || (variantParams as any).resourceOperationLike === CoreResourceOperation.SEARCH;\n const isListLike = operation === CoreResourceOperation.LIST\n || (variantParams as any).resourceOperationLike === CoreResourceOperation.LIST;\n\n if (isSearchLike) {\n const pageSize = (variantParams as any).pageSize ?? 20;\n const isSearchable = (variantParams as any).isSearchable !== false;\n const searchableFields = (variantParams as any).searchableFields || [];\n const searchableOptions = (variantParams as any).searchableOptions || { caseSensitive: false, fullMatchOnly: false };\n const rawFilterFields = (variantParams as any).filterFields || {};\n const sortFields = (variantParams as any).sortFields || [];\n const maxPaginatedResultPerPageLimit = (variantParams as any).maxPaginatedResultPerPageLimit || 50;\n\n const filterFields: Record<string, PrimitiveZodType> = {};\n Object.entries(rawFilterFields).forEach(([key, value]) => {\n if (typeof value !== 'function') {\n filterFields[key] = value as PrimitiveZodType;\n }\n });\n\n const searchQueryRequestSchema = createResourceSearchQueryRequestSchema({\n filterFields,\n allowedSortFields: sortFields,\n pagination: true,\n // The SAME value the response schema below is built from. That equality is the point:\n // request, repository and response must agree on one ceiling.\n maxPaginatedResultPerPageLimit\n });\n\n const paginatedResponseSchema = createResourcePaginatedResponseSchema({\n dataSchema: derivedSummarySchema,\n validateArrayConstraints: true,\n maxResultsPerPageLimit: maxPaginatedResultPerPageLimit\n });\n\n Object.assign(apiCallOperationFields, {\n pageSize,\n isSearchable,\n searchableFields,\n searchableOptions,\n filterFields: rawFilterFields,\n sortFields,\n maxPaginatedResultPerPageLimit,\n searchQueryRequestSchema,\n responseDto: paginatedResponseSchema,\n hasCustomResponseDto: false,\n });\n }\n\n if (isListLike) {\n const listEnrichment: Record<string, unknown> = {\n pageSize: (variantParams as any).pageSize ?? 20,\n searchEnabled: (variantParams as any).searchEnabled ?? true,\n filtersEnabled: (variantParams as any).filtersEnabled ?? true,\n // LIST has one pagination authority. Keep the effective ceiling on the resolved\n // operation so request/response DTO construction, repositories, auto-generated\n // SUMMARY/CONTEXT variants and API-reference projection all observe the same value.\n maxPaginatedResultPerPageLimit: (variantParams as any).maxPaginatedResultPerPageLimit ?? 100,\n };\n if ((variantParams as any).filterFields !== undefined) {\n listEnrichment.filterFields = (variantParams as any).filterFields;\n }\n if ((variantParams as any).sortFields !== undefined) {\n listEnrichment.sortFields = (variantParams as any).sortFields;\n }\n Object.assign(apiCallOperationFields, listEnrichment);\n }\n // ── End collection-view enrichment ──────────────────────────────\n\n // Add normal operation\n operations.push(apiCallOperationFields as ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>);\n\n // Add bulk operation if enabled\n if (haveBulkOperation) {\n const bulkDto = (() => {\n if (operationToCheck === CoreResourceOperation.CREATE) {\n return apiCallOperationFields.requestDto && apiCallOperationFields.requestDto !== z.object({})\n ? z.object({\n data: z.array(apiCallOperationFields.requestDto)\n })\n : z.object({\n data: z.array(z.object({}))\n });\n }\n\n if (apiCallOperationFields.requestDto instanceof z.ZodObject) {\n return Resources_BulkOperationBaseSchema.extend(\n getZodObjectShape(apiCallOperationFields.requestDto)\n );\n }\n\n return apiCallOperationFields.requestDto && apiCallOperationFields.requestDto !== z.object({})\n ? Resources_BulkOperationBaseSchema.and(apiCallOperationFields.requestDto)\n : Resources_BulkOperationBaseSchema;\n })();\n\n const bulkOperationFields = {\n ...apiCallOperationFields,\n isBulkOperation: true,\n isOperationDefault: false, // Bulk operations are never default\n requestDto: bulkDto\n };\n\n operations.push(bulkOperationFields as ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>);\n }\n\n } else {\n // Handle other variant types (CronJob, BatchJob, InternalCall, RepositoryOnly)\n const { variantType, ...specificFields } = variantParams; // Extract variantType and get rest\n\n const nonApiCallOperation = {\n ...baseOperationFields,\n ...specificFields\n };\n\n operations.push(nonApiCallOperation as ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>);\n }\n });\n\n // ========================================\n // PROCESS AUTO-VARIANTS FOR READ AND LIST\n // ========================================\n\n // Only process auto-variants for READ and LIST core operations\n if (operation === CoreResourceOperation.READ || operation === CoreResourceOperation.LIST) {\n // Reuse the flattened default URL-bearing operation so auto-variants inherit the same\n // resolved default identity as the rest of the resource config.\n const defaultApiCallVariant = [...operations].reverse().find((candidate) => (\n candidate.operationIdentifier === operation\n && isUrlisableOperationVariantType(candidate.variantType)\n && candidate.isOperationDefault === true\n && !('isBulkOperation' in candidate && candidate.isBulkOperation === true)\n )) as (\n ResourceConfiguration_Operation_ApiCall<TCustomOperationEnum, TCoreOperationEnum, TMainSchema> |\n Extract<\n ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>,\n { variantType: ResourceOperationVariantType.API_CALL_WITH_CALLBACK }\n >\n ) | undefined;\n\n if (!defaultApiCallVariant) {\n // Skip auto-variants if no default variant exists\n continue;\n }\n\n const defaultListCollectionFields = defaultApiCallVariant as typeof defaultApiCallVariant & CollectionViewFields_List;\n\n // Check which variants already exist\n const existingVariantKeys = new Set(\n operations.filter((candidate) => (\n candidate.operationIdentifier === operation\n && isUrlisableOperationVariantType(candidate.variantType)\n && candidate.variantKey\n && !('isBulkOperation' in candidate && candidate.isBulkOperation === true)\n ))\n .map((candidate) => candidate.variantKey!.toLowerCase())\n );\n\n // Helper to create auto-variant operation\n // Note: DTOs will be pre-computed by buildAllOperationDtos() after all operations are created.\n // We set temporary DTOs here for type compatibility, but they will be replaced.\n const createAutoVariantOperation = (\n variantKey: typeof OPERATION_VARIANT_KEY.SUMMARY | typeof OPERATION_VARIANT_KEY.CONTEXT,\n responseDto: z.ZodTypeAny,\n isDefault: boolean\n ): ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema> => {\n const baseOperationFields = {\n isDisabled: params.isDisabled ?? false,\n mainSchema: effectiveMainSchema,\n resourcePrimaryScope,\n resourceIdentifier,\n resourceFieldIdentifier,\n resourceRelationships: operationResourceRelationships,\n isSystemResource,\n operationIdentifier: operation,\n isOperationDefault: false, // Auto-variants are never operation default\n serviceRuntimeMode: config.serviceRuntimeMode || ResourceOperation_ServiceRuntimeMode.INLINE,\n requestDto: defaultApiCallVariant.requestDto || deriveRequestDto(operation as string, effectiveMainSchema, undefined), // Temporary - will be replaced by buildAllOperationDtos\n // Forwarded for the same reason as `unimplementedAcknowledgement` below: an auto-variant\n // is a projection of the default variant, so it inherits that variant's request contract\n // and must report the same provenance. Dropping it would make a projection of an\n // AUTHORED contract look auto-derived to the request-contract-breadth guard.\n hasCustomRequestDto: defaultApiCallVariant.hasCustomRequestDto ?? !!defaultApiCallVariant.requestDto,\n responseDto, // Temporary - will be replaced by buildAllOperationDtos\n notificationBadgeOperations: config.notificationBadgeOperations || [],\n userNotifications,\n m2mNotifications,\n variantType: defaultApiCallVariant.variantType,\n resourceOperationLike: defaultApiCallVariant.resourceOperationLike,\n requiredFeatures: normalizeRequiredFeatures(defaultApiCallVariant.requiredFeatures),\n riskLevel: defaultApiCallVariant.riskLevel || ResourceOperationRiskLevel.LOW,\n // Inherited like riskLevel: an auto-variant is a projection of the default variant. The\n // read-shaped projections are unlikely to need it, but inheriting keeps \"projection of\n // the default\" a single consistent rule rather than a per-field accident.\n clientRequestTimeoutMs: defaultApiCallVariant.clientRequestTimeoutMs,\n roles: defaultApiCallVariant.roles, // Inherit roles from default variant\n // Inherited for the same reason as roles: an auto-variant is a projection of the\n // default variant, so if the default is a known implementation gap its SUMMARY /\n // CONTEXT derivatives are equally unserviceable and must refuse identically.\n unimplementedAcknowledgement: defaultApiCallVariant.unimplementedAcknowledgement,\n // Inherited for the same reason: an auto-variant is a projection of the default variant,\n // so a SUMMARY / CONTEXT derivative of a step-up-gated operation must demand the same\n // proof. (Today the auto-variants are read-shaped and `enforceStepUpAuth` exempts reads\n // anyway — inheriting keeps that a property of the exemption list rather than an accident\n // of this projection.)\n requiresStepUpAuthentication: defaultApiCallVariant.requiresStepUpAuthentication,\n admitsCrossTenantPlatformAdministration: defaultApiCallVariant.admitsCrossTenantPlatformAdministration,\n // Inherited for the same reason as the cross-tenant flag: an auto-variant is a PROJECTION of\n // the default operation and must make the same addressing claim, or it would refuse the very\n // subjects the operation it projects is admitted to administer.\n admitsCrossSubjectUserAdministration: defaultApiCallVariant.admitsCrossSubjectUserAdministration,\n // Inherited for the same reason: an auto-variant is a projection of the default variant,\n // so it must make the same audit claim. Inheriting a `suppressGenericEvent` matters most —\n // the purpose-built event that supersedes the default covers its projections too, and a\n // projection that dropped the suppression would write the duplicate row the flag prevents.\n auditableEvent: defaultApiCallVariant.auditableEvent,\n mcp: defaultApiCallVariant.mcp, // Inherit MCP exposure from default variant (non-default variants aren't MCP-enumerated anyway)\n customServiceImplementationModes: defaultApiCallVariant.customServiceImplementationModes || [],\n basicPrefixOperation: defaultApiCallVariant.basicPrefixOperation,\n // Inherited alongside the hook itself — an auto-variant that ran the prefix without its\n // ownership declaration would drop the very field the hook exists to force.\n authoritativeFields: defaultApiCallVariant.authoritativeFields,\n // Inherited for the same reason as `roles`: an auto-variant is a PROJECTION of the default\n // variant, so it must confine a written reference exactly as the operation it projects does.\n // (Read-shaped auto-variants write nothing today, so this is inert for them — inheriting\n // keeps that a property of what they DO rather than an accident of this projection.)\n referenceConstraints: defaultApiCallVariant.referenceConstraints,\n httpVerb: defaultApiCallVariant.httpVerb,\n isApiKeyAccessDisabled: defaultApiCallVariant.isApiKeyAccessDisabled || false,\n isBulkOperation: false,\n tokenAuthentication: defaultApiCallVariant.tokenAuthentication,\n tokenGeneration: defaultApiCallVariant.tokenGeneration,\n tokenRevocation: defaultApiCallVariant.tokenRevocation,\n // Auto-variants (READ.summary, READ.context, LIST.summary, …)\n // inherit the default variant's rate-limit policy by design — a\n // single declaration on the default URL-bearing variant covers all\n // derived auto-variants. Authors who need a per-variant override\n // declare the variant explicitly instead of relying on auto-generation.\n rateLimit: defaultApiCallVariant.rateLimit,\n enabledCondition: defaultApiCallVariant.enabledCondition,\n isDefault: isDefault,\n variantKey: variantKey,\n ...(operation === CoreResourceOperation.LIST ? {\n // A generated representation changes only the response DATA SHAPE. It remains the same\n // collection operation, so its query contract must be identical to the canonical default\n // variant. Otherwise selecting SUMMARY or CONTEXT silently removes filters, sorting or\n // the authored page ceiling from the public contract.\n pageSize: defaultListCollectionFields.pageSize,\n searchEnabled: defaultListCollectionFields.searchEnabled,\n filtersEnabled: defaultListCollectionFields.filtersEnabled,\n filterFields: defaultListCollectionFields.filterFields,\n sortFields: defaultListCollectionFields.sortFields,\n maxPaginatedResultPerPageLimit: defaultListCollectionFields.maxPaginatedResultPerPageLimit,\n } : {}),\n ...(defaultApiCallVariant.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK ? {\n callbackUrl: defaultApiCallVariant.callbackUrl,\n callbackTimeout: defaultApiCallVariant.callbackTimeout,\n callbackRetryAttempts: defaultApiCallVariant.callbackRetryAttempts,\n } : {}),\n };\n\n // ── Build-time validation for auto-variant token configs ──\n if (defaultApiCallVariant.tokenGeneration) {\n validateTokenGenerationConfig(\n defaultApiCallVariant.tokenGeneration,\n resourceIdentifier as string,\n `${operation as string}.${variantKey}`,\n );\n }\n if (defaultApiCallVariant.tokenRevocation) {\n validateTokenRevocationConfig(\n defaultApiCallVariant.tokenRevocation,\n resourceIdentifier as string,\n `${operation as string}.${variantKey}`,\n );\n }\n\n return baseOperationFields as ResourceConfiguration_Operation<TCustomOperationEnum, TCoreOperationEnum, TMainSchema>;\n };\n\n // Generate READ.summary variant\n if (operation === CoreResourceOperation.READ && enableReadSummary && !existingVariantKeys.has(OPERATION_VARIANT_KEY.SUMMARY)) {\n const summaryResponseDto = derivedSummarySchema;\n operations.push(createAutoVariantOperation(OPERATION_VARIANT_KEY.SUMMARY, summaryResponseDto, false));\n }\n\n // Generate READ.context variant\n if (operation === CoreResourceOperation.READ && enableReadContext && !existingVariantKeys.has(OPERATION_VARIANT_KEY.CONTEXT)) {\n const contextResponseDto = effectiveMainSchema; // Full schema for context\n operations.push(createAutoVariantOperation(OPERATION_VARIANT_KEY.CONTEXT, contextResponseDto, false));\n }\n\n // Generate LIST.summary variant\n if (operation === CoreResourceOperation.LIST && enableListSummary && !existingVariantKeys.has(OPERATION_VARIANT_KEY.SUMMARY)) {\n const summaryResponseDto = createResourcePaginatedResponseSchema({\n dataSchema: derivedSummarySchema,\n validateArrayConstraints: true,\n maxResultsPerPageLimit: defaultListCollectionFields.maxPaginatedResultPerPageLimit,\n });\n operations.push(createAutoVariantOperation(OPERATION_VARIANT_KEY.SUMMARY, summaryResponseDto, false));\n }\n\n // Generate LIST.context variant\n if (operation === CoreResourceOperation.LIST && enableListContext && !existingVariantKeys.has(OPERATION_VARIANT_KEY.CONTEXT)) {\n const contextResponseDto = createResourcePaginatedResponseSchema({\n dataSchema: effectiveMainSchema,\n validateArrayConstraints: true,\n maxResultsPerPageLimit: defaultListCollectionFields.maxPaginatedResultPerPageLimit,\n });\n operations.push(createAutoVariantOperation(OPERATION_VARIANT_KEY.CONTEXT, contextResponseDto, false));\n }\n }\n }\n\n // ========================================\n // CROSS-OPERATION TOKEN VALIDATION (E1)\n // ========================================\n\n // Detect invalid pairing: tokenGeneration with consumeAt:EXCHANGE + tokenAuthentication with ADDITIVE policy\n // When token is consumed at exchange, no consumable token value is carried into the session,\n // so ADDITIVE operations that require the token will silently fail.\n const generatedTokenTypes = new Map<string, 'EXCHANGE' | 'TARGET_OPERATION'>();\n const additiveTokenTypes = new Set<string>();\n\n for (const op of operations) {\n if ('tokenGeneration' in op && op.tokenGeneration?.createsOneOffSession && op.tokenGeneration.consumeAt) {\n generatedTokenTypes.set(op.tokenGeneration.tokenType as string, op.tokenGeneration.consumeAt);\n }\n if ('tokenAuthentication' in op && op.tokenAuthentication?.policy === TokenAuthenticationPolicy.ADDITIVE) {\n for (const t of op.tokenAuthentication.types) {\n additiveTokenTypes.add(t as string);\n }\n }\n }\n\n for (const [tokenType, consumeAt] of generatedTokenTypes) {\n if (consumeAt === 'EXCHANGE' && additiveTokenTypes.has(tokenType)) {\n throw createConfigurationError(\n `[${resourceIdentifier}] tokenType '${tokenType}': consumeAt is 'EXCHANGE' but another operation ` +\n `uses this tokenType with ADDITIVE policy. EXCHANGE consumes the token before the session starts, ` +\n `so no token value will be available for ADDITIVE operations. Use 'TARGET_OPERATION' instead.`,\n );\n }\n }\n\n // ========================================\n // BUILD FINAL RESULT\n // ========================================\n\n // Build the final resource configuration to pass to buildAllOperationDtos\n // W7.3a: Warn if isAnonymizable but no operation has APP_ANONYMOUS role\n if (isAnonymizable) {\n const hasAnonymousRole = operations.some(op => op.roles.includes('APP_ANONYMOUS'));\n if (!hasAnonymousRole) {\n console.warn(\n `[${resourceIdentifier}] isAnonymizable: true but no operation has APP_ANONYMOUS in roles. ` +\n `Anonymous users won't be able to access any operation on this resource.`\n );\n }\n }\n\n operations.push(\n ...createGeneratedRelationshipBulkOperations(\n operations,\n relevantRelationships,\n resourceIdentifier,\n {\n ...coreResourceShared_FieldIdentifier,\n [resourceIdentifier]: resourceFieldIdentifier,\n }\n )\n );\n\n const generatedFileDiscoverySchema = ResourcesConfigOperationsDtosBuilderUtils.buildSchemaWithInheritance(\n effectiveMainSchema,\n inheritenceSchemaDefinition,\n );\n\n operations.push(\n ...createGeneratedFileRegenerateOperations({\n operations,\n resourceIdentifier,\n resourceFieldIdentifier,\n mainSchema: effectiveMainSchema,\n generatedFileDiscoverySchema,\n persistenceAdapter,\n })\n );\n\n // AFTER the file-regenerate companions, and over the same fully-assembled set: a generated\n // relationship-bulk operation is never a LIST/SEARCH, so ordering cannot change the outcome — but\n // deriving from the complete set means a future generated LIST would be covered without a second\n // call site to remember.\n operations.push(\n ...createGeneratedCollectionExportOperations({\n operations,\n resourceIdentifier,\n })\n );\n\n // ── Fail-closed guard: no anonymous BULK MUTATION (W7.3a hardening) ─────\n //\n // An anonymous caller may legitimately be granted single-record CREATE / READ\n // / LIST / UPDATE / DELETE (e.g. draft-notes lead capture), but a bulk MUTATION\n // (CREATE_MANY / UPDATE_MANY / DELETE_MANY) granted to `APP_ANONYMOUS` is an\n // unauthenticated mass-write surface — a whole-collection destructive footgun\n // no app should be able to author by accident. The framework provided ZERO\n // enforcement here (only a non-blocking \"isAnonymizable without any anon op\"\n // warning existed), so this fails closed at config-build time. Read-shaped\n // collection ops (LIST / SEARCH / COUNT) are intentionally NOT flagged —\n // anonymous listing of one's own anonymous rows is a supported pattern.\n //\n // Runs over the FULLY-assembled operation set (authored + generated\n // relationship-bulk + file-regenerate) so a generated bulk op that inherited\n // anonymous roles from its base is caught too. Zero violations exist today.\n for (const operation of operations) {\n // A resource op is a bulk MUTATION iff EITHER its identifier is a core bulk\n // verb (create_many / update_many / delete_many) OR it carries the\n // `isBulkOperation` flag. The flag is sufficient on its own: the factory\n // rejects `haveBulkOperation` on READ / LIST above (\"read and list are not\n // bulkable\"), so `isBulkOperation === true` is GUARANTEED to be a mutation —\n // it covers the opt-in bulk UPDATE/DELETE companions AND the generated\n // relationship-bulk ops (whose `operationIdentifier` is a relationship id,\n // not a core verb, so clause 1 alone would miss them). `operationIdentifier`\n // is the (core | custom) op union and `isBulkOperation` exists only on some\n // variants of the discriminated union — narrow with `in` and compare by\n // string value (enum members ARE their string values); the CronJob variant\n // carries neither.\n const isBulkMutation =\n isCoreBulkMutationOperation(operation.operationIdentifier)\n || ('isBulkOperation' in operation && operation.isBulkOperation === true);\n if (isBulkMutation && operation.roles.includes('APP_ANONYMOUS')) {\n throw createConfigurationError(\n `[${resourceIdentifier}] operation '${String(operation.operationIdentifier)}' grants APP_ANONYMOUS on a ` +\n `bulk MUTATION (create_many / update_many / delete_many). Unauthenticated mass-write is forbidden — ` +\n `anonymous access is only permitted on single-record operations (and read-shaped collection ops: ` +\n `list / search / count). Remove APP_ANONYMOUS from this operation's roles.`\n );\n }\n }\n\n // ── RESOLVABILITY half of the retention operation contract ──────────────\n //\n // The presence half ran with the other `retentionPolicy` validations above: it proved\n // UPDATE_MANY / READ / LIST are declared. Being DECLARED is not the same as being REACHABLE,\n // and the gap between the two is a config that boots green and breaks on the first erasure.\n //\n // All three retention primitives resolve their operation through\n // `ResourcesRegistryBackendService.getServiceOperationPathDefault`, which admits ONLY the\n // variant types in `SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES` and only when the variant is\n // the operation DEFAULT. `REPOSITORY_ONLY` is route-less exactly like `INTERNAL_CALL` — so it\n // is the natural-looking choice for \"the capability without a new HTTP surface\" — but it is\n // deliberately excluded there and served by the separate `getRepositoryOperationPathDefault`\n // transport. A `REPOSITORY_ONLY` UPDATE_MANY therefore satisfied the presence check and then\n // failed to resolve mid-erasure. That is not hypothetical: the `USERS` opt-in shipped it, every\n // config test passed, and only a completion review caught it.\n //\n // Runs HERE, not with the presence half, because `isOperationDefault` is computed by the\n // operations loop above (it is variant-type-LOCAL — a lone variant marked `isDefault: false`\n // yields NO default for its transport group, which this check must see). Reads the SAME\n // predicate the resolver applies, so a config this guard accepts is a config the resolver can\n // serve, by construction rather than by two lists agreeing.\n if (retentionPolicy?.mode) {\n for (const { operation: requiredOperation, primitive } of RETENTION_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS) {\n if (operations.some((candidate) => isServiceResolvableDefaultOperation(candidate, requiredOperation))) {\n continue;\n }\n\n const declaredVariants = operations\n .filter((candidate) => candidate.operationIdentifier === requiredOperation)\n .map((candidate) => `${candidate.variantType}${candidate.variantKey ? `:${candidate.variantKey}` : ''}` +\n `${candidate.isOperationDefault ? ' (default)' : ''}`);\n\n throw createConfigurationError(\n `[${resourceIdentifier}] retentionPolicy requires ${requiredOperation} to be SERVICE-RESOLVABLE, but it ` +\n `declares no DEFAULT variant of an accepted type. Declared variants: ` +\n `[${declaredVariants.length > 0 ? declaredVariants.join(', ') : 'none'}]. The retention primitive ` +\n `${primitive} resolves this operation through getServiceOperationPathDefault, which accepts only ` +\n `[${SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES.join(', ')}] and only the operation default. ` +\n `REPOSITORY_ONLY is route-less but is served by the SEPARATE getRepositoryOperationPathDefault ` +\n `transport, so it passes the \"operation exists\" check and then FAILS TO RESOLVE the moment an ` +\n `erasure runs. Use ${ResourceOperationVariantType.INTERNAL_CALL} for a capability that must stay ` +\n `route-less (it is both route-less and service-resolvable), and make sure it is the default for ` +\n `its transport group — a lone variant marked \\`isDefault: false\\` leaves the group with NO default.`\n );\n }\n }\n\n // ── RESOLVABILITY half of the ANONYMIZABLE operation contract ───────────\n //\n // Same two-halves shape as retention above, for the other dynamic-loop capability. The presence\n // half proved that each requirement group has an alternative DECLARED; this proves one of them\n // is REACHABLE by `AnonymousSessionBackendService`, whose three primitives\n // (`listAnonymousRecords` / `updateManyAsSystem` / `deleteOwnedRecords`) all resolve through\n // `getServiceOperationPathDefault`.\n //\n // Runs HERE rather than with the presence half for the same reason retention's does:\n // `isOperationDefault` is computed by the operations loop above, and it is variant-type-LOCAL —\n // a lone variant marked `isDefault: false` leaves its transport group with NO default.\n //\n // Reads the SAME predicate the resolver applies (`isServiceResolvableDefaultOperation`), and the\n // same predicate `deleteOwnedRecords` probes with when it chooses between DELETE_MANY and\n // per-row DELETE — so the guard, the runtime chooser and the resolver cannot disagree.\n if (isAnonymizable) {\n for (const { operations: alternatives, primitive, why } of ANONYMIZABLE_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS) {\n if (alternatives.some((alternative) =>\n operations.some((candidate) => isServiceResolvableDefaultOperation(candidate, alternative)))) {\n continue;\n }\n\n const declaredVariants = operations\n .filter((candidate) => alternatives.includes(candidate.operationIdentifier as CoreResourceOperation))\n .map((candidate) => `${String(candidate.operationIdentifier)}/${candidate.variantType}` +\n `${candidate.variantKey ? `:${candidate.variantKey}` : ''}${candidate.isOperationDefault ? ' (default)' : ''}`);\n\n throw createConfigurationError(\n `[${resourceIdentifier}] isAnonymizable: true requires ${describeOperationAlternatives(alternatives)} ` +\n `to be SERVICE-RESOLVABLE, but no accepted DEFAULT variant is declared. Declared variants: ` +\n `[${declaredVariants.length > 0 ? declaredVariants.join(', ') : 'none'}]. The anonymous-session ` +\n `primitive ${primitive} (${why}) resolves through getServiceOperationPathDefault, which accepts ` +\n `only [${SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES.join(', ')}] and only the operation default. ` +\n `REPOSITORY_ONLY is route-less but is served by the SEPARATE getRepositoryOperationPathDefault ` +\n `transport, so it passes the \"operation exists\" check and then FAILS TO RESOLVE the moment an ` +\n `anonymous session converts or expires. Use ${ResourceOperationVariantType.INTERNAL_CALL} for a ` +\n `capability that must stay route-less, and make sure it is the default for its transport group.`\n );\n }\n }\n\n const resourceConfig: ResourceConfiguration<TCustomOperationEnum, TCoreOperationEnum, TMainSchema> = {\n isDisabled: params.isDisabled ?? false,\n resourcePrimaryScope,\n resourceIdentifier,\n resourceFieldIdentifier,\n coreOperations,\n customOperation,\n mainSchema: effectiveMainSchema,\n resourceRelationships: processedResourceRelationships,\n inheritenceSchemaDefinition,\n persistenceAdapter,\n persistenceAdapterIsolation,\n httpApiBinding: resolvedHttpApiBinding,\n introspectionBinding,\n externalDataPipeline,\n isSystemResource,\n primaryKeyIdentifiesInitiator,\n systemAccessPolicy: effectiveSystemAccessPolicy,\n isAnonymizable,\n transpositionPolicy: isAnonymizable\n ? (transpositionPolicy ?? ResourceTranspositionPolicy.ADD)\n : ResourceTranspositionPolicy.ADD,\n // Normalize (mirror transpositionPolicy): the RESOLVED retentionPolicy is present IFF the resource\n // opted in. An absent `mode` is an opt-in-shaped opt-out that injects no marker\n // and derives no grants, so it must NOT ship a truthy resolved value — else a consumer doing\n // `if (config.retentionPolicy)` would treat a non-opted-in resource as retention-governed.\n retentionPolicy: retentionPolicy?.mode ? retentionPolicy : undefined,\n // Paired with `retentionPolicy` by the guards above, so these two are present together or not at all.\n dataSubjectPolicy: retentionPolicy?.mode ? dataSubjectPolicy : undefined,\n // Normalize (mirror retentionPolicy): the resolved portabilityPolicy is present IFF the\n // resource actually declared a default. An absent `defaultProvenance` is a policy-shaped\n // opt-out, and shipping a truthy-but-empty object would make an Art. 20 export believe a\n // default exists and silently include fields nobody classified.\n portabilityPolicy: portabilityPolicy?.defaultProvenance ? portabilityPolicy : undefined,\n operations: operations // Temporary - will be replaced\n };\n\n // Pre-compute all DTOs for each operation using buildAllOperationDtos\n // Note: Registry is empty for now - it's mainly used for cross-references in nested DTOs\n // If needed, the registry can be passed as a parameter to the factory function\n const resourceRegistry = new Map<ResourceType, any>();\n const operationsWithDtos = operations.map(operation =>\n ResourcesConfigOperationsDtosBuilderUtils.buildAllOperationDtos(\n operation,\n resourceConfig,\n resourceRegistry\n )\n );\n\n return {\n isDisabled: params.isDisabled ?? false,\n resourcePrimaryScope,\n resourceIdentifier,\n resourceFieldIdentifier,\n coreOperations,\n customOperation,\n mainSchema: effectiveMainSchema,\n resourceRelationships: processedResourceRelationships,\n inheritenceSchemaDefinition,\n persistenceAdapter,\n persistenceAdapterIsolation,\n httpApiBinding: resolvedHttpApiBinding,\n introspectionBinding,\n externalDataPipeline,\n isSystemResource,\n primaryKeyIdentifiesInitiator,\n systemAccessPolicy: effectiveSystemAccessPolicy,\n isAnonymizable,\n transpositionPolicy: isAnonymizable\n ? (transpositionPolicy ?? ResourceTranspositionPolicy.ADD)\n : ResourceTranspositionPolicy.ADD,\n // Normalize (mirror transpositionPolicy): resolved retentionPolicy present IFF opted-in — see the\n // internal resourceConfig object above for the full rationale.\n retentionPolicy: retentionPolicy?.mode ? retentionPolicy : undefined,\n // Paired with `retentionPolicy` by the guards above, so these two are present together or not at all.\n dataSubjectPolicy: retentionPolicy?.mode ? dataSubjectPolicy : undefined,\n // Normalize (mirror retentionPolicy): the resolved portabilityPolicy is present IFF the\n // resource actually declared a default. An absent `defaultProvenance` is a policy-shaped\n // opt-out, and shipping a truthy-but-empty object would make an Art. 20 export believe a\n // default exists and silently include fields nobody classified.\n portabilityPolicy: portabilityPolicy?.defaultProvenance ? portabilityPolicy : undefined,\n operations: operationsWithDtos\n };\n}\n"]}