@wildo-ai/external-connectors-models 1.1.4 → 1.1.6

package/dist/esm/protocols/rest-operations.external-connectors-models.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"rest-operations.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/protocols/rest-operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQH,oDAAoD;AACpD,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,sGAAsG;IACtG,8CAAa,CAAA;IACb,gDAAe,CAAA;IACf,kDAAiB,CAAA;AACnB,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,gDAAa,CAAA;IACb,sEAAmC,CAAA;IACnC,0DAAuB,CAAA;IACvB,uFAAuF;IACvF,gDAAa,CAAA;AACf,CAAC,EANW,+BAA+B,KAA/B,+BAA+B,QAM1C;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,2BAMX;AAND,WAAY,2BAA2B;IACrC,gDAAiB,CAAA;IACjB,4CAAa,CAAA;IACb,gDAAiB,CAAA;IACjB,qFAAqF;IACrF,4CAAa,CAAA;AACf,CAAC,EANW,2BAA2B,KAA3B,2BAA2B,QAMtC;AA0OD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAN,IAAY,yBAeX;AAfD,WAAY,yBAAyB;IACnC;;;;;OAKG;IACH,oDAAuB,CAAA;IACvB;;;;;OAKG;IACH,kEAAqC,CAAA;AACvC,CAAC,EAfW,yBAAyB,KAAzB,yBAAyB,QAepC","sourcesContent":["/**\n * The REST OPERATION vocabulary — what an operation IS, independent of who executes one.\n *\n * Moved here from `@wildo-ai/external-connectors-private/backend` on 2026-09-06 (#378), and the\n * reason is a measurement rather than tidiness. A generated provider's operation catalogue is loaded\n * LAZILY on purpose: the loader contract forbids evaluating it at boot, because a provider whose\n * operations are eager puts every vendor's operations into every process's boot graph. But the\n * catalogue module needs `ProviderRestParameterLocation` and `ProviderRestRequestBodyEncoding` as\n * VALUES, and their only public door was the backend barrel — so reading two string enums pulled the\n * entire backend provider surface in behind them:\n *\n * | import | heap | time |\n * |---|---|---|\n * | `@wildo-ai/external-connectors-models` | 20.8 MB | 39 ms |\n * | `@wildo-ai/external-connectors-private/backend` | 160.7 MB | 251 ms |\n *\n * 161 MB to answer \"is this parameter in the path or the query\". The vocabulary belongs here for a\n * reason that survives the measurement, too: it describes what an operation IS — its method, its\n * path template, where its parameters ride — and none of that is backend runtime. The arrow already\n * pointed this way, since this package has no dependency on the private backend and the private\n * backend depends on it.\n */\n\nimport { z } from 'zod';\n\nimport { API_HttpMethod } from '../core/commons.external-connectors-models.schemas';\nimport { ExternalOperation_Classification } from '../core/operation-classification.external-connectors-models.schemas';\nimport type { ExternalProvider_ConnectionTarget } from '../core/security.external-connectors-models.schemas';\n\n/** Where a declared parameter rides on the wire. */\nexport enum ProviderRestParameterLocation {\n  /** Substituted into a `{token}` of the path template. Always required — a path cannot have a hole. */\n  PATH = 'path',\n  QUERY = 'query',\n  HEADER = 'header',\n}\n\n/**\n * How the request body is encoded. The ETL read surface only ever needed JSON; a hand-authored\n * write reaches vendors that take form bodies (OAuth-adjacent endpoints, older CRMs) and file\n * uploads, so the encoding is DECLARED per operation rather than inferred from the method.\n */\nexport enum ProviderRestRequestBodyEncoding {\n  JSON = 'json',\n  FORM_URLENCODED = 'form-urlencoded',\n  MULTIPART = 'multipart',\n  /** A raw text body; `contentType` on the declaration says which media type is sent. */\n  TEXT = 'text',\n}\n\n/**\n * How a listing operation continues. A HINT the caller reads, never something the executor acts\n * on: an executor that paged on its own would decide a caller's memory budget for it, and the\n * ETL lane already owns paging as a discipline (drift-safe continuation only).\n */\nexport enum ProviderRestPaginationStyle {\n  OFFSET = 'offset',\n  PAGE = 'page',\n  CURSOR = 'cursor',\n  /** The vendor returns its own continuation URL (`@odata.nextLink`, `links.next`). */\n  LINK = 'link',\n}\n\n/** One declared parameter: a wire name, where it rides, and which input field feeds it. */\nexport interface ProviderRestOperationParameter {\n  /** The name ON THE WIRE (`page_size`, `X-Vendor-Version`, or the `{token}` in the path). */\n  readonly name: string;\n  readonly in: ProviderRestParameterLocation;\n  /**\n   * The INPUT field that feeds it, when the two differ (`pageSize` → `page_size`). Absent means\n   * the input field is spelled exactly like the wire name. Declared, never camel/snake-guessed:\n   * a guess that is wrong drops a parameter silently and the vendor answers a valid-looking\n   * default page.\n   */\n  readonly from?: string;\n  /** PATH parameters are required whatever this says; for QUERY/HEADER, absent means optional. */\n  readonly required?: boolean;\n  /** A literal value sent on every call — for a version pin or a fixed format selector. */\n  readonly constantValue?: string;\n  readonly description?: string;\n}\n\n/** How the request body is built from the operation's input. */\nexport interface ProviderRestOperationRequestBody {\n  readonly encoding: ProviderRestRequestBodyEncoding;\n  /**\n   * The input field carrying the whole body. Absent = the body is every input field NOT consumed\n   * by a declared parameter — the ordinary shape, and the reason parameters declare `from`.\n   */\n  readonly from?: string;\n  /** For `TEXT`: the media type actually sent (`text/csv`, `application/xml`). */\n  readonly contentType?: string;\n}\n\n/** Where the payload sits inside a response, and how a listing continues. */\nexport interface ProviderRestOperationPagination {\n  readonly style: ProviderRestPaginationStyle;\n  /** OFFSET/PAGE/CURSOR: the request parameter names the caller advances. */\n  readonly limitParam?: string;\n  readonly offsetParam?: string;\n  readonly pageParam?: string;\n  readonly cursorParam?: string;\n  /** CURSOR/LINK: dot-path in the RESPONSE carrying the next cursor or the next URL. */\n  readonly nextPath?: string;\n}\n\n/**\n * A provider operation, hand-authored. The unit an application addresses:\n * `executeProviderOperation({ providerRef: 'slack', operationId: 'conversations.list', input })`.\n */\nexport interface ProviderRestOperation {\n  /** Unique within the provider, and the address an ETL binding reference uses. */\n  readonly operationId: string;\n  /**\n   * The lazy-load unit. `operations('conversations')` answers only this domain's operations, so a\n   * vendor with hundreds need not evaluate them all to run one.\n   */\n  readonly domain: string;\n  readonly method: API_HttpMethod;\n  /** Relative to the provider's base URL. `{token}` interpolates a PATH parameter of that name. */\n  readonly pathTemplate: string;\n  readonly summary?: string;\n  /**\n   * Whether the operation MUTATES the vendor.\n   *\n   * ONE vocabulary for every operation catalogue, whatever produced it: a hand-authored operation\n   * and a generated one are the same concept, and two enums over the same two values is precisely\n   * the drift D1 exists to remove. Read by an ETL binding reference (which refuses to serve a read\n   * surface from a WRITE), by the audit trail as the axis a reviewer filters on first, and by a UI\n   * deciding whether to confirm.\n   *\n   * The name carried a source catalogue's spelling until 2026-09-06 and no longer does — an\n   * operation's EFFECT is not a property of where its definition came from.\n   */\n  readonly classification: ExternalOperation_Classification;\n  readonly parameters?: readonly ProviderRestOperationParameter[];\n  readonly requestBody?: ProviderRestOperationRequestBody;\n  /**\n   * Zod schema the caller's input is parsed through BEFORE anything is compiled. A typed client\n   * (S3b) derives its argument type from it. Absent = the input is passed through unvalidated,\n   * which is legal for a thin wrapper and honest about carrying no contract.\n   */\n  readonly inputSchema?: z.ZodType;\n  /**\n   * Zod schema the RESPONSE is parsed through. Absent = the parsed body is returned as `unknown`.\n   * A vendor adding a field must never break a call, so authors should keep these permissive; the\n   * value is in naming the fields a caller may rely on, not in policing the vendor.\n   */\n  readonly outputSchema?: z.ZodType;\n  /** Dot-path to the payload inside the response body. Absent = the body IS the payload. */\n  readonly resultPath?: string;\n  readonly pagination?: ProviderRestOperationPagination;\n  /**\n   * OAuth scopes (or vendor permission names) the credential must carry. DECLARED in S3a and not\n   * yet CHECKED: checking it needs the composed registry's view of the secrets contract, which is\n   * #329's. Recorded as owed rather than half-enforced — a check that silently passes is worse\n   * than no check.\n   */\n  readonly requiredScopes?: readonly string[];\n  /**\n   * Whether re-sending this request is safe. Absent = derived from the method: GET, HEAD, OPTIONS,\n   * PUT and DELETE are idempotent, POST and PATCH are not.\n   * spec-cite: RFC 9110 §9.2.2 (PUT, DELETE and the safe methods are idempotent) and §9.2.1\n   * (GET, HEAD, OPTIONS, TRACE are safe).\n   * Declare it TRUE on a POST the vendor documents as idempotent (an idempotency-key endpoint);\n   * declaring it wrongly is how a retried timeout charges a customer twice.\n   */\n  readonly idempotent?: boolean;\n  /** Narrows the provider's semantics for this one operation (a slow export, a tight endpoint). */\n  readonly remoteCallSemantics?: Partial<ProviderRestCallSemantics>;\n  /** Set when the vendor has deprecated it; the executor logs once per operation, never refuses. */\n  readonly deprecated?: {\n    readonly reason: string;\n    readonly since?: string;\n    readonly replacedByOperationId?: string;\n  };\n}\n\n/** What one `operations(domain?)` call answers. */\nexport interface ProviderRestOperationCatalogue {\n  /** The domains this load carries — the whole set when called with no argument. */\n  readonly domains: readonly string[];\n  /** Keyed by `operationId`. */\n  readonly operations: Readonly<Record<string, ProviderRestOperation>>;\n}\n\n/**\n * The lazy catalogue loader — the seam #330's host loader consumes (interface note on #331).\n *\n * MUST NOT be called during composition, discovery or boot: it exists so a provider package can\n * `import()` its own operation module only when a run needs it, and calling it at boot puts every\n * provider's operations back into every process's boot graph, which is the thing on-demand\n * loading exists to remove. Async, idempotent, and memoized by the executor per\n * `(providerRef, domain)` — a loader may assume one call per pair and must stay correct on two.\n *\n * The values it returns carry live Zod schemas, so a catalogue is an IN-PROCESS value and is\n * never serializable into a runtime artifact or any JSON the CLI emits.\n */\nexport type ProviderRestOperationCatalogueLoader = (domain?: string) => Promise<ProviderRestOperationCatalogue>;\n\n/**\n * Provider-level call semantics: the defaults every operation of this provider runs under.\n *\n * Structurally the executable subset of the ETL's `HttpApiRemoteCallSemantics`, and deliberately\n * NOT that type: the ETL's lives in `@wildo-ai/saas-models/external-data` and carries\n * `maxIdSetSize`, an ETL query-translation bound that means nothing to a provider operation.\n * Importing it here would point the PROVIDER contract at the ETL read surface — backwards, since\n * the ETL references provider operations and not the reverse. Three fields is the price of\n * keeping that arrow pointing the right way.\n */\nexport interface ProviderRestCallSemantics {\n  /** Per-attempt timeout. */\n  readonly timeoutMs: number;\n  readonly retry: {\n    /** Total attempts including the first; 1 disables retry. */\n    readonly maxAttempts: number;\n    /** Linear backoff base — attempt N waits `backoffMs * (N - 1)`. */\n    readonly backoffMs: number;\n  };\n  /** A local sliding-window ceiling; the call REFUSES when exhausted rather than queueing. */\n  readonly maxRequestsPerMinute?: number;\n}\n\n\n/**\n * A provider whose credential is MINTED by an authorization-code exchange rather than pasted.\n *\n * Recorded because the source catalogues state it and nothing else does. 131 of the 699 transposed\n * vendors declare OAuth2, and their authorize URL, token URL and scopes exist nowhere in this\n * repository except the catalogue that was read — so extracting them and keeping them only in a\n * comment (which is what the transposer did until 2026-09-07) means the delegated-authorization lane\n * re-derives 131 vendors' endpoints by hand.\n *\n * ## What it does NOT change\n *\n * The wire placement. An OAuth2 access token rides in the same header as an API key —\n * `Authorization: Bearer …` — so `apiKey.headerName` and `apiKey.prefix` still describe the request,\n * and `apiKey.secretRef` still names the slot the credential is read from. What this block adds is\n * where that value COMES FROM: an exchange, per organization or per user, refreshable — rather than\n * an operator pasting a long-lived token into an environment variable.\n *\n * That distinction is the whole point. Without it a provider declares a static bearer key and, if an\n * operator happens to paste a long-lived token, WORKS — while advertising a credential model the\n * vendor does not offer, with no authorize step, no refresh and no per-tenant token. A wrong\n * configuration that works is worse than one that fails, because nothing surfaces it.\n *\n * The FLOW is not here and is not implied: connected accounts, the authorization round trip, refresh\n * and revocation are their own lane. This is the declaration that lane consumes.\n */\nexport interface ProviderRestOAuth2 {\n  /** Where the user is sent to grant access. Carries the vendor's own default scopes when it states them. */\n  readonly authorizeUrl: string;\n  /** Where an authorization code (or a refresh token) is exchanged for an access token. */\n  readonly tokenUrl: string;\n  /**\n   * Scopes the vendor's own catalogue entry asked for. Advisory rather than enforced: an application\n   * may need fewer, and an operation's `requiredScopes` is the finer statement. Kept because it is\n   * the only record of what the vendor expects for the operations transposed beside it.\n   */\n  readonly scopes?: readonly string[];\n  /**\n   * Env-var names resolving the APPLICATION's registration with the vendor. These are the two values\n   * an operator genuinely does paste — they identify the integration, not the end user — and they\n   * are separate from `apiKey.secretRef`, which names the minted access token.\n   */\n  readonly clientIdSecretRef?: string;\n  readonly clientSecretSecretRef?: string;\n  /**\n   * Placeholders the endpoints above carry, which a CONNECTION must supply before either URL is a\n   * URL at all — `{cloud}`, `{tenantId}`, `{region}`, `{domain}`.\n   *\n   * Measured over the transposed catalogue on 2026-09-08: of the 96 vendors that recovered both\n   * endpoints, **21 carry at least one placeholder**, led by `{cloud}` (18), `{location}` (10) and\n   * `{tenantId}` (6). Microsoft's authorize URL is\n   * `https://{cloud}/{tenantId}/oauth2/v2.0/authorize`, and no amount of application configuration\n   * supplies those: which Azure cloud and which directory are facts about the ACCOUNT BEING\n   * CONNECTED, known only to the person connecting it.\n   *\n   * So this is not decoration on the endpoint strings — it is the difference between a vendor that\n   * can be connected and one that cannot. Without it the flow would build\n   * `https://{cloud}/…/authorize`, send somebody to a hostname containing a brace, and fail in the\n   * browser rather than at the point where the missing input could have been asked for.\n   *\n   * DERIVED from the endpoint strings rather than authored, so a vendor whose URL gains a\n   * placeholder declares one the next time the batch runs. Absent — not empty — when the endpoints\n   * are plain, which is the common case and must stay distinguishable from \"nobody has looked\".\n   *\n   * Deliberately NOT a judgement about which connections a provider admits. That is a recorded\n   * decision in the catalogue record and is never read from a vendor's API surface; this is a\n   * mechanical fact about a string.\n   */\n  readonly connectionParameters?: readonly string[];\n}\n\n\n/**\n * Vendors whose credential is COMPUTED per request rather than sent as a fixed header.\n *\n * A static header covers bearer tokens and API keys, which is most of the world. It cannot express a\n * signature: AWS Signature Version 4 signs the method, the canonical path, the sorted query, a\n * subset of headers, a SHA-256 of the payload and a timestamp, with a key derived from the secret,\n * the date, the region and the service — so the header's VALUE differs for every request and none of\n * its inputs exist when a provider module is authored.\n *\n * Until this existed, such a vendor could not be expressed at all — not badly, not partially. There\n * was no `if` to write, because the field where the answer goes did not exist. 45 transposed actions\n * across `amazon-s3`, `amazon-ses`, `amazon-textract`, `amazon-secrets-manager`, `amazon-sqs`,\n * `amazon-bedrock`, `azure-blob-storage`, `azure-communication-services` and `azure-openai` are\n * blocked on it (#373).\n */\nexport enum ProviderRestSigningScheme {\n  /**\n   * AWS Signature Version 4 — the `Authorization: AWS4-HMAC-SHA256 …` scheme used by every current\n   * AWS service API.\n   * spec-cite: AWS General Reference, \"Signature Version 4 signing process\"\n   * (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv4-signing-process.html)\n   */\n  AWS_SIGV4 = 'AWS_SIGV4',\n  /**\n   * Azure Storage shared-key — `Authorization: SharedKey <account>:<signature>` over a canonicalized\n   * request and resource.\n   * spec-cite: Azure Storage REST, \"Authorize with Shared Key\"\n   * (https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key)\n   */\n  AZURE_SHARED_KEY = 'AZURE_SHARED_KEY',\n}\n\n/**\n * How a provider signs each request.\n *\n * Declared by the provider module and executed by the engine, with NO vendor branch in the executor:\n * the scheme is data, and the signer dispatches on it exhaustively. That is the same discipline the\n * rest of the provider contract keeps — a consumer branches on a contract field, never on a\n * provider ref.\n *\n * The credential is TWO values for both schemes (an identity and a secret), and optionally a third\n * for temporary credentials, which is why it cannot ride in the single `apiKey.secretRef` slot.\n */\nexport interface ProviderRestRequestSigning {\n  readonly scheme: ProviderRestSigningScheme;\n  /** Env-var naming the identity half — an AWS access-key id, an Azure storage account name. */\n  readonly keyIdSecretRef: string;\n  /** Env-var naming the secret half. */\n  readonly secretKeySecretRef: string;\n  /**\n   * Env-var naming a session token, for temporary credentials (STS, a role assumption). Absent means\n   * long-lived credentials; present-but-unset is treated as long-lived rather than as an error,\n   * because the same provider serves both.\n   */\n  readonly sessionTokenSecretRef?: string;\n  /**\n   * AWS_SIGV4: the region and service that scope the derived key. Both are part of the SIGNATURE,\n   * not merely of the URL, so a wrong value fails authentication rather than routing — which is why\n   * they are declared rather than parsed out of the host.\n   */\n  readonly region?: string;\n  readonly service?: string;\n  /**\n   * Env-var overriding {@link region} per deployment, for an application that runs in more than one.\n   * The declared value is the default.\n   */\n  readonly regionEnvVarName?: string;\n}\n\n/**\n * The one function a generated typed client needs, as a TYPE.\n *\n * A generated provider package must not import the engine's runtime to be callable: that would put\n * the whole backend into the module graph of anything that touches a vendor, which is precisely the\n * weight #378 removed (models 20.8 MB against the backend barrel's 160.7 MB). So a client is a\n * FACTORY that takes the executor as an argument — the application wires its own, the package\n * declares only this signature, and nothing crosses at runtime.\n *\n * R3's ergonomics bought with a type rather than a dependency.\n *\n * ## The connection is a parameter, and OPTIONAL for a reason that is not convenience\n *\n * Omitted means the application's own account, acting as itself — the floor, and the only connection\n * that needs no store and no authorization. That default is what keeps the ordinary single-account\n * call as short as it should be.\n *\n * It could not be anything BUT a parameter. One execution may legitimately spend several tenants'\n * accounts — a user action pushing a message to every organization that user belongs to — so a client\n * that read the owner from ambient state could not vary it per call, and the fan-out would be\n * inexpressible through the generated surface even though the engine beneath it supports one.\n */\nexport type ProviderOperationExecute = (\n  providerRef: string,\n  operationId: string,\n  input: Readonly<Record<string, unknown>>,\n  connection?: ExternalProvider_ConnectionTarget,\n) => Promise<unknown>;\n"]}
+{"version":3,"file":"rest-operations.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/rest-operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAQH,wJAAwJ;AACxJ,oDAAoD;AACpD,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,sGAAsG;IACtG,8CAAa,CAAA;IACb,gDAAe,CAAA;IACf,kDAAiB,CAAA;AACnB,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,+BAaX;AAbD,WAAY,+BAA+B;IACzC,gDAAa,CAAA;IACb,sEAAmC,CAAA;IACnC,0DAAuB,CAAA;IACvB,uFAAuF;IACvF,gDAAa,CAAA;IACb;;;;;OAKG;IACH,oDAAiB,CAAA;AACnB,CAAC,EAbW,+BAA+B,KAA/B,+BAA+B,QAa1C;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,4BAOX;AAPD,WAAY,4BAA4B;IACtC,wFAAwF;IACxF,6CAAa,CAAA;IACb,oGAAoG;IACpG,6CAAa,CAAA;IACb,qGAAqG;IACrG,6CAAa,CAAA;AACf,CAAC,EAPW,4BAA4B,KAA5B,4BAA4B,QAOvC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,2BAMX;AAND,WAAY,2BAA2B;IACrC,gDAAiB,CAAA;IACjB,4CAAa,CAAA;IACb,gDAAiB,CAAA;IACjB,qFAAqF;IACrF,4CAAa,CAAA;AACf,CAAC,EANW,2BAA2B,KAA3B,2BAA2B,QAMtC;AA4QD,wJAAwJ;AACxJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,oGAAoG;IACpG,wDAAyB,CAAA;IACzB,yHAAyH;IACzH,8CAAe,CAAA;AACjB,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAwBD;;;;;GAKG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,yCAAmB,CAAA;AACrB,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAAC,KAGjD;IACC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,YAAkE,EAAQ,EAAE;QACxG,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,iDAAiD,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACrH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;gBAClF,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,yCAAyC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/G,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChF,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,gBAAgB,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;YACvH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;QAAE,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClG,OAAO,CAAC,IAAI,CAAC,gIAAgI,CAAC,CAAC;IACjJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAGpD;IACC,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC;AAC3G,CAAC;AA8PD,iJAAiJ;AACjJ,6HAA6H;AAC7H,MAAM,CAAC,MAAM,2CAA2C,GAAG,kBAAkB,CAAC;AAgC9E,uHAAuH;AACvH,MAAM,UAAU,gCAAgC,CAAC,QAAoC,EAAE,IAAY;IACjG,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1F,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACtF,OAAO,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mCAAmC,CACjD,MAAiE,EACjE,IAAY;IAEZ,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,gCAAgC,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;IACxH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uCAAuC,CAAC,QAAoC,EAAE,MAAc;IAC1G,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,2CAA2C,CAAC;QACtG,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,MAAM,CAAC,EAAE;QAC/E,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAiE,EACjE,KAAa;IAEb,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC;IAC3E,qHAAqH;IACrH,mHAAmH;IACnH,oDAAoD;IACpD,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,SAAS,CAAC,UAAU,CAAC,2CAA2C,CAAC,EAAE,CAAC;gBACtE,IAAI,IAAI,KAAK,SAAS,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gCAAgC,CAAC,QAAQ,EAAE,IAAI,CAAC;oBAAE,OAAO,EAAE,CAAC;gBACrI,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CACtD,MAAiE,EACjE,KAAa;IAEb,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,+BAA+B,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,SAAS,CAAC;AACtE,CAAC;AACD,yEAAyE;AAEzE,2JAA2J;AAC3J;;GAEG;AACH,MAAM,CAAN,IAAY,oCAiBX;AAjBD,WAAY,oCAAoC;IAC9C;;;;;;OAMG;IACH,6DAAqB,CAAA;IACrB;;;;;;OAMG;IACH,yFAAiD,CAAA;AACnD,CAAC,EAjBW,oCAAoC,KAApC,oCAAoC,QAiB/C;AAYD,mFAAmF;AAEnF;;;;;;;;;GASG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAA4E;IAChI,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,eAAe,iCAAiC,CAAC,CAAC;IACnI,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACrG,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,8BAA8B,CAAC,CAAC;IAC1H,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;QAC5I,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,+BAA+B,MAAM,+BAA+B,CAAC,CAAC;QAC1M,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,wBAAwB,KAAK,4BAA4B,CAAC,CAAC;QAC1J,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAC;QAC9F,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrJ,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,KAAK,gDAAgD,2CAA2C,EAAE,CAAC,CAAC;QACjM,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,UAAU,CAAC,2CAA2C,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,eAAe,iBAAiB,KAAK,gFAAgF,CAAC,CAAC;iBAClO,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,eAAe,iBAAiB,KAAK,+CAA+C,CAAC,CAAC;QACtL,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACpD,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAE,CAAC;YAC9C,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;YACjD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;mBAC1G,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;mBAC/F,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;YAClO,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,cAAc,MAAM,UAAU,OAAO,6DAA6D,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAuCD,iEAAiE;AACjE,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,yFAAyF;IACzF,sEAAqC,CAAA;IACrC,iFAAiF;IACjF,gDAAe,CAAA;AACjB,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,iBAA8D,EAC9D,KAAa,EACb,UAAyC;IAEzC,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,GAAG,GAAG,UAAU,KAAK,6BAA6B,CAAC,KAAK;QAC5D,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACxG,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,6CAA6C,CACpD,iBAA8D,EAC9D,QAA2B,EAC3B,UAAyC;IAEzC,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,CAAC,UAAU,KAAK,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAChI,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,6CAA6C,CAAC,CAAC;QAC5G,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,KAAK,oBAAoB,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sCAWX;AAXD,WAAY,sCAAsC;IAChD;;;OAGG;IACH,2DAAiB,CAAA;IACjB;;;OAGG;IACH,qEAA2B,CAAA;AAC7B,CAAC,EAXW,sCAAsC,KAAtC,sCAAsC,QAWjD;AAED,6HAA6H;AAC7H,MAAM,CAAN,IAAY,iCAWX;AAXD,WAAY,iCAAiC;IAC3C;;;;OAIG;IACH,0GAAqE,CAAA;IACrE,8GAA8G;IAC9G,kFAA6C,CAAA;IAC7C,iHAAiH;IACjH,gEAA2B,CAAA;AAC7B,CAAC,EAXW,iCAAiC,KAAjC,iCAAiC,QAW5C;AAUD;;;GAGG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAAa;IAClE,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,4CAA4C,CAAC,CAAC,CAAC;IACtF,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,4CAA4C,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAwC,EAAE,CAAC;IACxD,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,WAAW,CAAC,CAAC;IACxI,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,oBAAoB,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,gCAAgC,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAAa;IAClE,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE;QACf,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,WAAW,CAAC,CAAC,CAAC,sCAAsC,CAAC,MAAM;QAC/I,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;KAChB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,mCAAmC,GAAG,qCAAqC,CAAC;AAElF;;;GAGG;AACH,MAAM,UAAU,gDAAgD,CAAC,SAA4C;IAC3G,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,wCAAwC,CAAC,CAAC;IACzH,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjI,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,6CAA6C,CAAC,SAAS,CAAC,iBAAiB,EAAE,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC;IACnJ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,yCAeX;AAfD,WAAY,yCAAyC;IACnD;;;;OAIG;IACH,8DAAiB,CAAA;IACjB;;;;OAIG;IACH,0DAAa,CAAA;IACb,oGAAoG;IACpG,4EAA+B,CAAA;AACjC,CAAC,EAfW,yCAAyC,KAAzC,yCAAyC,QAepD;AAED,sHAAsH;AACtH,MAAM,CAAN,IAAY,uCA+CX;AA/CD,WAAY,uCAAuC;IACjD;;;;;;;;;;;OAWG;IACH,8EAAmC,CAAA;IACnC;;;;;OAKG;IACH,sFAA2C,CAAA;IAC3C;;;;;;;;;OASG;IACH,0FAA+C,CAAA;IAC/C;;;;;;;;;;;;;OAaG;IACH,4GAAiE,CAAA;AACnE,CAAC,EA/CW,uCAAuC,KAAvC,uCAAuC,QA+ClD;AAoFD;;;GAGG;AACH,MAAM,CAAN,IAAY,oCA2BX;AA3BD,WAAY,oCAAoC;IAC9C;;;;;OAKG;IACH,6FAAqD,CAAA;IACrD;;;;OAIG;IACH,uFAA+C,CAAA;IAC/C;;;OAGG;IACH,+GAAuE,CAAA;IACvE;;;;;;OAMG;IACH,mFAA2C,CAAA;AAC7C,CAAC,EA3BW,oCAAoC,KAApC,oCAAoC,QA2B/C;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,mFAAmF,CAAC;AAEpI;;;;;;;GAOG;AACH,MAAM,UAAU,kDAAkD,CAChE,WAAuJ,EACvJ,SAA8C;IAE9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,aAAa,EAAE,CAAC;QACrF,OAAO,CAAC,qDAAqD,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,uCAAuC,CAAC,mBAAmB,EAAE,CAAC;QACnF,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,MAAM,EAAE,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,sBAAsB,SAAS,CAAC,iBAAiB,4EAA4E,CAAC,CAAC;QAC9I,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,uCAAuC,CAAC,8BAA8B,EAAE,CAAC;QAC9F,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/F,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QACtH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,6CAA6C,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,6BAA6B,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAChL,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,uCAAuC,CAAC,qBAAqB,EAAE,CAAC;QACrF,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,kDAAkD,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,8BAA8B,KAAK,IAAI,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,MAAM,EAAE,CAAC;QACnI,OAAO,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,MAAM,EAAE,CAAC;YAC9E,iGAAiG;YACjG,mGAAmG;YACnG,oCAAoC;YACpC,MAAM,KAAK,GAAG,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,4DAA4D,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAClD,6FAA6F;QAC7F,6EAA6E;QAC7E,gHAAgH;QAChH,oGAAoG;QACpG,MAAM,uBAAuB,GAAG,WAAW,CAAC,iBAAiB,KAAK,SAAS,IAAI,WAAW,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QACpJ,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC1I,OAAO,CAAC,IAAI,CAAC,gBAAgB,MAAM,+CAA+C,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,gBAAgB,MAAM,sGAAsG,CAAC,CAAC;QAC7I,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,6CAA6C,CAAC,SAAS,CAAC,iBAAiB,EAAE,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9J,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,8FAA8F;QAC9F,MAAM,cAAc,GAAG,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC9H,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,kDAAkD,cAAc,aAAa,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yCAAyC,CAAC,QAAgB;IACxE,MAAM,OAAO,GAA2C,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACnE,OAAO,CAAC,oCAAoC,CAAC,wBAAwB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,qBAAqB,CAAC,CAAC;IAC5I,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACtF,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,mBAAmB,CAAC,CAAC;YACvE,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC,QAAQ,CAAC;aAC1E,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,CAAC,CAAC;QAClG,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,iCAAiC,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,4CAA4C,GAAG,+BAA+B,CAAC;AAE5F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,0CAA0C,CAAC,QAAgB;IACzE,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,YAAY,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,GAAG,GAAG,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,GAAkD,EAAE,CAAC;IACtE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,4CAA4C,CAAC,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC;YAC1B,CAAC,CAAC,yCAAyC,CAAC,MAAM;YAClD,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,KAAK,GAAG,eAAe,IAAI,KAAK,GAAG,YAAY;gBACvE,CAAC,CAAC,yCAAyC,CAAC,IAAI;gBAChD,CAAC,CAAC,yCAAyC,CAAC,aAAa,CAAC;QAC9D,MAAM,iBAAiB,GAAG,QAAQ,KAAK,yCAAyC,CAAC,IAAI;eAChF,KAAK,KAAK,eAAe,GAAG,CAAC;eAC7B,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC;QAC9C,MAAM,gBAAgB,GAAG,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,iBAAiB,IAAI,KAAK,KAAK,eAAe,GAAG,CAAC;YACzI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC;YACvD,CAAC,CAAC,SAAS,CAAC;QACd,mHAAmH;QACnH,MAAM,iBAAiB,GAAG,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/J,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;IAChK,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAGD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAN,IAAY,yBAeX;AAfD,WAAY,yBAAyB;IACnC;;;;;OAKG;IACH,oDAAuB,CAAA;IACvB;;;;;OAKG;IACH,kEAAqC,CAAA;AACvC,CAAC,EAfW,yBAAyB,KAAzB,yBAAyB,QAepC","sourcesContent":["/**\n * The REST OPERATION vocabulary — what an operation IS, independent of who executes one.\n *\n * Moved here from `@wildo-ai/external-connectors-private/backend` on 2026-09-06 (#378), and the\n * reason is a measurement rather than tidiness. A generated provider's operation catalogue is loaded\n * LAZILY on purpose: the loader contract forbids evaluating it at boot, because a provider whose\n * operations are eager puts every vendor's operations into every process's boot graph. But the\n * catalogue module needs `ProviderRestParameterLocation` and `ProviderRestRequestBodyEncoding` as\n * VALUES, and their only public door was the backend barrel — so reading two string enums pulled the\n * entire backend provider surface in behind them:\n *\n * | import | heap | time |\n * |---|---|---|\n * | `@wildo-ai/external-connectors-models` | 20.8 MB | 39 ms |\n * | `@wildo-ai/external-connectors-private/backend` | 160.7 MB | 251 ms |\n *\n * 161 MB to answer \"is this parameter in the path or the query\". The vocabulary belongs here for a\n * reason that survives the measurement, too: it describes what an operation IS — its method, its\n * path template, where its parameters ride — and none of that is backend runtime. The arrow already\n * pointed this way, since this package has no dependency on the private backend and the private\n * backend depends on it.\n *\n * ## This is the ONLY description of a REST provider — two earlier ones were deleted\n *\n * `rest-api.external-connectors-models.schemas.ts` described REST providers twice over, and both\n * descriptions are gone. Neither should come back beside this module.\n *\n * - **An OpenAPI-shaped operation layer** (`REST_API_OperationSpecSchema`,\n *   `REST_API_OperationContextSchema`, `REST_API_OperationDefinition`, `API_Parameter*`,\n *   `API_ContentType`) — deleted 2026-09-06 by #331. Ten exported symbols and zero code readers: a\n *   provider that authored one compiled, shipped, and was invisible to every runtime.\n * - **A profile / configuration / status triple** (`REST_API_Provider_Profile`,\n *   `REST_API_Provider_Configuration`, `REST_APIProvider_StatusSchema`) — deleted 2026-09-12 (#18).\n *   Its only reader was the `ExternalProvider_ExchangeProtocol` union, itself read by nothing but a\n *   drift test pinning it to the enum, and deleted in the same change. Its `pagination.style` was an\n *   anonymous `\"offset\" | \"cursor\" | \"page\" | \"link\"` restating {@link ProviderRestPaginationStyle}.\n *\n * WHERE a REST API lives and how it authenticates is the `rest` arm of the backend runtime contract\n * (`@wildo-ai/external-connectors-private/backend`); WHAT can be called against it is\n * {@link ProviderRestOperation}, executed by `ProviderOperationExecutorBackendService`. A second\n * description of either is not a missing feature — it is the drift that makes an authoring surface\n * untrustworthy, because an author cannot tell which of two shapes is the one that runs. If an\n * OpenAPI document is ever read (a second mapper input), it feeds `ProviderRestOperation` like\n * every other source.\n */\n\nimport { z } from 'zod';\n\nimport { API_HttpMethod } from '../core/commons.external-connectors-models.schemas';\nimport { ExternalOperation_Classification } from '../core/operation-classification.external-connectors-models.schemas';\nimport type { ExternalProvider_ConnectionTarget } from '../core/security.external-connectors-models.schemas';\n\n/** @wildo_source:part:start external-connectors.models.rest-operation-contract facet:layer:shared facet:family:provider facet:audience:app-developer */\n/** Where a declared parameter rides on the wire. */\nexport enum ProviderRestParameterLocation {\n  /** Substituted into a `{token}` of the path template. Always required — a path cannot have a hole. */\n  PATH = 'path',\n  QUERY = 'query',\n  HEADER = 'header',\n}\n\n/**\n * How the request body is encoded. The ETL read surface only ever needed JSON; a hand-authored\n * write reaches vendors that take form bodies (OAuth-adjacent endpoints, older CRMs) and file\n * uploads, so the encoding is DECLARED per operation rather than inferred from the method.\n */\nexport enum ProviderRestRequestBodyEncoding {\n  JSON = 'json',\n  FORM_URLENCODED = 'form-urlencoded',\n  MULTIPART = 'multipart',\n  /** A raw text body; `contentType` on the declaration says which media type is sent. */\n  TEXT = 'text',\n  /**\n   * Raw bytes (#367, folding #364) — an image, a PDF, a file upload a vendor takes as the whole body.\n   * `contentType` is REQUIRED, by the TEXT arm's rule: a body without its media type is not addressable.\n   * The input must supply a `Uint8Array` (a Node `Buffer` is one); nothing is converted into bytes here,\n   * because a string encoded under a guessed charset is exactly how an upload arrives corrupted.\n   */\n  BINARY = 'binary',\n}\n\n/**\n * How the vendor's ANSWER is read (#367, folding #364).\n *\n * The request side could already send TEXT and the transport could already read TEXT and NONE, while\n * the operation declaration could only say JSON — so an operation against a `text/csv` export could be\n * authored and then failed at runtime as `INVALID_JSON`, a contract-breach message for a declaration\n * the contract had no way to state. This is the missing half of that asymmetry.\n */\nexport enum ProviderRestResponseDecoding {\n  /** Parse the body as JSON. The default, and what an absent `responseDecoding` means. */\n  JSON = 'json',\n  /** Keep the body as text — a CSV export, an XML document. The operation's output is that string. */\n  TEXT = 'text',\n  /** Read nothing — a write whose answer carries no information (a 204). The output is `undefined`. */\n  NONE = 'none',\n}\n\n/**\n * How a listing operation continues. A HINT the caller reads, never something the executor acts\n * on: an executor that paged on its own would decide a caller's memory budget for it, and the\n * ETL lane already owns paging as a discipline (drift-safe continuation only).\n */\nexport enum ProviderRestPaginationStyle {\n  OFFSET = 'offset',\n  PAGE = 'page',\n  CURSOR = 'cursor',\n  /** The vendor returns its own continuation URL (`@odata.nextLink`, `links.next`). */\n  LINK = 'link',\n}\n\n/** One declared parameter: a wire name, where it rides, and which input field feeds it. */\nexport interface ProviderRestOperationParameter {\n  /** The name ON THE WIRE (`page_size`, `X-Vendor-Version`, or the `{token}` in the path). */\n  readonly name: string;\n  readonly in: ProviderRestParameterLocation;\n  /**\n   * The INPUT field that feeds it, when the two differ (`pageSize` → `page_size`). Absent means\n   * the input field is spelled exactly like the wire name. Declared, never camel/snake-guessed:\n   * a guess that is wrong drops a parameter silently and the vendor answers a valid-looking\n   * default page.\n   */\n  readonly from?: string;\n  /** PATH parameters are required whatever this says; for QUERY/HEADER, absent means optional. */\n  readonly required?: boolean;\n  /** A literal value sent on every call — for a version pin or a fixed format selector. */\n  readonly constantValue?: string;\n  readonly description?: string;\n}\n\n/** How the request body is built from the operation's input. */\nexport interface ProviderRestOperationRequestBody {\n  readonly encoding: ProviderRestRequestBodyEncoding;\n  /**\n   * The input field carrying the whole body. Absent = the body is every input field NOT consumed\n   * by a declared parameter — the ordinary shape, and the reason parameters declare `from`.\n   */\n  readonly from?: string;\n  /** For `TEXT` and `BINARY`: the media type actually sent (`text/csv`, `application/pdf`). Required for both. */\n  readonly contentType?: string;\n  /**\n   * A JSON body sent INSIDE one named property: `envelope: 'data'` sends `{ \"data\": { …the body… } }` (#333).\n   *\n   * Asana answers `data: Missing input` to a task whose fields arrive at the top level — its API reads\n   * every write from a `data` wrapper, which the source catalogue builds in its request helper and the\n   * transposer never saw. Declared here rather than modelled as a nested input, so the INPUT stays flat:\n   * the fields a person fills in, and the fields an `inputOptions` key names, are the fields they see.\n   *\n   * JSON only. Any other encoding with an envelope is refused by name when the request is compiled — a\n   * form, text or binary body has no property to wrap it in.\n   */\n  readonly envelope?: string;\n}\n\n/** Where the payload sits inside a response, and how a listing continues. */\nexport interface ProviderRestOperationPagination {\n  readonly style: ProviderRestPaginationStyle;\n  /** OFFSET/PAGE/CURSOR: the request parameter names the caller advances. */\n  readonly limitParam?: string;\n  readonly offsetParam?: string;\n  readonly pageParam?: string;\n  readonly cursorParam?: string;\n  /** CURSOR/LINK: dot-path in the RESPONSE carrying the next cursor or the next URL. */\n  readonly nextPath?: string;\n}\n\n/**\n * Where an input's CHOICES come from: another operation of the same provider, run through the SAME\n * connection, whose answer lists the values a person may pick (#333).\n *\n * The shape every workflow product converged on, and deliberately not a value stored on the connection.\n * A workspace, a project, a channel are choices WITHIN an account, made per call: Zapier fills a\n * dynamic dropdown with \"a live API call\", Make fills a module field through an RPC that \"must have the\n * same connection\", n8n's resource locator lists through the node's credentials, and the Activepieces\n * source this catalogue is scraped from declares Asana's workspace as a required dropdown whose options\n * are fetched with the connected account. A connection records only what the vendor REPORTED when it\n * was authorized ({@link ProviderRestOAuth2.accountRefResponsePath}).\n *\n * Declaring an options source does not make the options operation reachable from a browser: it is its\n * own operation, and `providers.browserOperations` must list it like any other.\n *\n * @example\n * // Asana: a task's project is chosen from the projects of the chosen workspace.\n * inputOptions: {\n *   workspace: { operationId: 'list_workspaces', valuePath: 'gid', labelPath: 'name' },\n *   project: { operationId: 'list_projects', valuePath: 'gid', labelPath: 'name', dependsOn: { workspace: 'workspace' } },\n * }\n */\nexport interface ProviderRestOperationInputOptions {\n  /** The operation that lists the choices. Same provider; its output (after its own `resultPath`) must be an array. */\n  readonly operationId: string;\n  /** That operation's catalogue domain, when it differs from the one being called. */\n  readonly domain?: string;\n  /** Dot-path, inside each listed item, to the value the input receives (`gid`). */\n  readonly valuePath: string;\n  /** Dot-path, inside each listed item, to the text a person reads (`name`). Vendor content, never derived from the value. */\n  readonly labelPath: string;\n  /**\n   * Inputs the options depend on: `{ <options-operation input field>: <this operation's input field> }`.\n   * A choice that is not yet made is REFUSED by name rather than listed as empty — \"no projects\" and\n   * \"choose a workspace first\" are different answers, and only one of them is true.\n   */\n  readonly dependsOn?: Readonly<Record<string, string>>;\n}\n\n/**\n * A provider operation, hand-authored. The unit an application addresses:\n * `executeProviderOperation({ providerRef: 'slack', operationId: 'conversations.list', input })`.\n */\nexport interface ProviderRestOperation {\n  /** Unique within the provider, and the address an ETL binding reference uses. */\n  readonly operationId: string;\n  /**\n   * The lazy-load unit. `operations('conversations')` answers only this domain's operations, so a\n   * vendor with hundreds need not evaluate them all to run one.\n   */\n  readonly domain: string;\n  readonly method: API_HttpMethod;\n  /** Relative to the provider's base URL. `{token}` interpolates a PATH parameter of that name. */\n  readonly pathTemplate: string;\n  readonly summary?: string;\n  /**\n   * Whether the operation MUTATES the vendor.\n   *\n   * ONE vocabulary for every operation catalogue, whatever produced it: a hand-authored operation\n   * and a generated one are the same concept, and two enums over the same two values is precisely\n   * the drift D1 exists to remove. Read by an ETL binding reference (which refuses to serve a read\n   * surface from a WRITE), by the audit trail as the axis a reviewer filters on first, and by a UI\n   * deciding whether to confirm.\n   *\n   * The name carried a source catalogue's spelling until 2026-09-06 and no longer does — an\n   * operation's EFFECT is not a property of where its definition came from.\n   */\n  readonly classification: ExternalOperation_Classification;\n  readonly parameters?: readonly ProviderRestOperationParameter[];\n  readonly requestBody?: ProviderRestOperationRequestBody;\n  /**\n   * Zod schema the caller's input is parsed through BEFORE anything is compiled. A typed client\n   * (S3b) derives its argument type from it. Absent = the input is passed through unvalidated,\n   * which is legal for a thin wrapper and honest about carrying no contract.\n   */\n  readonly inputSchema?: z.ZodType;\n  /**\n   * Zod schema the RESPONSE is parsed through. Absent = the parsed body is returned as `unknown`.\n   * A vendor adding a field must never break a call, so authors should keep these permissive; the\n   * value is in naming the fields a caller may rely on, not in policing the vendor.\n   */\n  readonly outputSchema?: z.ZodType;\n  /**\n   * How the answer is read. Absent = `JSON`, so every operation authored before this field existed\n   * reads exactly as it did.\n   *\n   * It also sets the default `Accept` header — `application/json` for JSON, `*\\/*` otherwise — which a\n   * declared `Accept` HEADER parameter overrides when a vendor needs a specific media type.\n   *\n   * Two combinations are refused by name when the request is compiled, because each describes a payload\n   * that cannot exist: `resultPath` beside `TEXT` or `NONE` (there is no structure to walk), and\n   * `outputSchema` beside `NONE` (there is nothing to parse). `outputSchema` beside `TEXT` is legal and\n   * validates the string.\n   */\n  readonly responseDecoding?: ProviderRestResponseDecoding;\n  /** Dot-path to the payload inside the response body. Absent = the body IS the payload. JSON answers only. */\n  readonly resultPath?: string;\n  readonly pagination?: ProviderRestOperationPagination;\n  /**\n   * OAuth scopes (or vendor permission names) the credential must carry, as the exact strings the vendor\n   * grants. CHECKED before the request leaves (#979): `ProviderOperationExecutorBackendService` compares them\n   * with the scopes recorded on the spent grant and refuses with the missing ones named when any is absent.\n   * A grant that records no scopes (a pasted key, a vendor that does not echo `scope`) proceeds, and the\n   * call's audit row says the check could not be made — refusing there would break every such vendor.\n   *\n   * Until 2026-09-14 this said \"declared and not checked\"; checking needed the granted set on the grant,\n   * which the connected-accounts lane now stores. Two things not to confuse it\n   * with: `ProviderRestOAuth2.scopes` is the vendor's ADVISORY default set, and the wildo-cli\n   * `getProviderApiKey({ requiredScopes })` parameter is a list of secret-contract SLUGS — a\n   * different concept sharing the name, which no production caller feeds from this field. As of\n   * 2026-09-12 no generated provider declares it either.\n   */\n  readonly requiredScopes?: readonly string[];\n  /**\n   * Whether re-sending this request is safe. Absent = derived from the method: GET, HEAD, OPTIONS,\n   * PUT and DELETE are idempotent, POST and PATCH are not.\n   * spec-cite: RFC 9110 §9.2.2 (PUT, DELETE and the safe methods are idempotent) and §9.2.1\n   * (GET, HEAD, OPTIONS, TRACE are safe).\n   * Declare it TRUE on a POST the vendor documents as idempotent (an idempotency-key endpoint);\n   * declaring it wrongly is how a retried timeout charges a customer twice.\n   */\n  readonly idempotent?: boolean;\n  /** Narrows the provider's semantics for this one operation (a slow export, a tight endpoint). */\n  readonly remoteCallSemantics?: Partial<ProviderRestCallSemantics>;\n  /**\n   * Where each input's choices come from, keyed by INPUT field name. Absent for an input a caller types.\n   * See {@link ProviderRestOperationInputOptions}.\n   */\n  readonly inputOptions?: Readonly<Record<string, ProviderRestOperationInputOptions>>;\n  /** Set when the vendor has deprecated it; the executor logs once per operation, never refuses. */\n  readonly deprecated?: {\n    readonly reason: string;\n    readonly since?: string;\n    readonly replacedByOperationId?: string;\n  };\n}\n\n/** What one `operations(domain?)` call answers. */\nexport interface ProviderRestOperationCatalogue {\n  /** The domains this load carries — the whole set when called with no argument. */\n  readonly domains: readonly string[];\n  /** Keyed by `operationId`. */\n  readonly operations: Readonly<Record<string, ProviderRestOperation>>;\n  /**\n   * Which package contributed an operation that the provider's OWN module does not declare, keyed by\n   * `operationId` (#1672). Absent on every catalogue a provider module loads itself; set only by the\n   * framework when it merges an opted-in AUGMENTATION into a provider it does not own.\n   *\n   * A catalogue value and not a property of the operation, on purpose: an operation declaration is the\n   * augmentation author's data, and a field the author could write would let a package claim to be\n   * somebody else. The merge refuses a loaded catalogue that already carries this field.\n   *\n   * Read by the operation executor, which writes the contributor into the `PROVIDER_OPERATION_CALL` audit\n   * row: a call spending a shared grant must say whose code declared the request it sent.\n   */\n  readonly augmentedBy?: Readonly<Record<string, ProviderRestOperationContributor>>;\n}\n\n/** The package that contributed an operation to a provider it does not own (#1672). */\nexport interface ProviderRestOperationContributor {\n  /** The augmentation package's npm name, as its own manifest states it. */\n  readonly packageName: string;\n  /** The installed version of that package, as `wildo config sync` read it from the manifest. */\n  readonly packageVersion: string;\n}\n/** @wildo_source:part:end external-connectors.models.rest-operation-contract */\n\n/**\n * The lazy catalogue loader — the seam #330's host loader consumes (interface note on #331).\n *\n * MUST NOT be called during composition, discovery or boot: it exists so a provider package can\n * `import()` its own operation module only when a run needs it, and calling it at boot puts every\n * provider's operations back into every process's boot graph, which is the thing on-demand\n * loading exists to remove. Async, idempotent, and memoized by the executor per\n * `(providerRef, domain)` — a loader may assume one call per pair and must stay correct on two.\n *\n * The values it returns carry live Zod schemas, so a catalogue is an IN-PROCESS value and is\n * never serializable into a runtime artifact or any JSON the CLI emits.\n */\nexport type ProviderRestOperationCatalogueLoader = (domain?: string) => Promise<ProviderRestOperationCatalogue>;\n\n/**\n * Provider-level call semantics: the defaults every operation of this provider runs under.\n *\n * Structurally the executable subset of the ETL's `HttpApiRemoteCallSemantics`, and deliberately\n * NOT that type: the ETL's lives in `@wildo-ai/saas-models/external-data` and carries\n * `maxIdSetSize`, an ETL query-translation bound that means nothing to a provider operation.\n * Importing it here would point the PROVIDER contract at the ETL read surface — backwards, since\n * the ETL references provider operations and not the reverse. Three fields is the price of\n * keeping that arrow pointing the right way.\n */\nexport interface ProviderRestCallSemantics {\n  /** Per-attempt timeout. */\n  readonly timeoutMs: number;\n  readonly retry: {\n    /** Total attempts including the first; 1 disables retry. */\n    readonly maxAttempts: number;\n    /** Linear backoff base — attempt N waits `backoffMs * (N - 1)`. */\n    readonly backoffMs: number;\n  };\n  /**\n   * This REF's share of its connection's allowance: a sliding-window ceiling counted for every call made\n   * through this ref, whichever account it spends (#1729).\n   *\n   * It is a CEILING UNDER the connection's own budgets ({@link ProviderRateBudgetDeclaration}, declared by\n   * the connection's base), never a statement of the vendor's limit: several refs of one shared connection\n   * each keep their own ceiling and all draw on the one vendor allowance together.\n   */\n  readonly maxRequestsPerMinute?: number;\n}\n\n/** @wildo_source:part:start external-connectors.models.connection-rate-budgets facet:layer:shared facet:family:provider facet:audience:app-developer */\n/**\n * WHOSE allowance a vendor counts a request against, under one connection (#1729).\n *\n * A connection is one application registration at the vendor (one OAuth client, one API project) — the\n * base provider's, however many refs spend it. Vendors meter on two axes of it, and a provider declares the\n * one each of its limits uses:\n *\n * | vendor wording | member |\n * |---|---|\n * | Microsoft Graph \"per app across all tenants\"; Google \"per minute per project\" | {@link CONNECTION} |\n * | Google \"per minute per user per project\"; Dataverse \"for each user\"; Graph \"per app per tenant\" / \"per app and mailbox\" when the grant owner IS that tenant or mailbox | {@link OWNER} |\n *\n * spec-cite: https://learn.microsoft.com/en-us/graph/throttling-limits — the global-limits table (\"Per app across all\n * tenants\") and the scope list \"per app across all tenants, per tenant for all apps, per app per tenant\"; and\n * https://developers.google.com/workspace/drive/api/guides/limits — \"per minute per project\" / \"per minute per user per\n * project\". Fetched 2026-09-28.\n *\n * Deliberately NOT a member: \"per tenant for all apps\" (Graph). It counts OTHER applications' calls, which this\n * deployment cannot see, so no local counter can hold it; the vendor's `429` is the only honest signal there.\n */\nexport enum ProviderRateBudgetPartition {\n  /** One allowance for the whole connection — every ref, every account it acts for, every process. */\n  CONNECTION = 'connection',\n  /** One allowance per account the connection acts for — the grant's owner (a person, an organization, the deployment). */\n  OWNER = 'owner',\n}\n\n/**\n * One limit a vendor publishes, as the connection's BASE provider declares it (#1729).\n *\n * Read only from the connection's base: a member ref's declaration is inert, exactly like a member's OAuth client,\n * because the limit belongs to the registration and the base owns the registration. Declared on the REST contract\n * (`rest.rateBudgets`) for a connection whose tokens serve one resource, and on each OAuth2 AUDIENCE\n * (`oauth2.audiences.<id>.rateBudgets`) for a connection spanning several — Microsoft Graph and a Dataverse\n * environment are metered by different services with different numbers, so one list for both would be wrong for one.\n *\n * Counted by the engine BEFORE a request leaves: a call waits for room (bounded, see the executor's\n * `rateBudgetWaitMs`) instead of spending a request the vendor would answer with `429`. The window is SLIDING, which\n * is at least as strict as a vendor's fixed window of the same length.\n */\nexport interface ProviderRateBudgetDeclaration {\n  /** How many requests the window admits. */\n  readonly maxRequests: number;\n  /** The window's length, in seconds, as the vendor states it (Graph's global limit is per 10 s, Dataverse's per 300 s). */\n  readonly windowSeconds: number;\n  /** Whose allowance it is — see {@link ProviderRateBudgetPartition}. */\n  readonly partition: ProviderRateBudgetPartition;\n}\n\n/**\n * Where a budget was COUNTED, as the call that spent it observed (#1729): `shared` when the deployment's shared store\n * (Redis) counted it for every process of the application — backend replicas, minions, workers — and `process` when\n * only this process did, because no shared store is configured here or it did not answer. Recorded on the call's audit\n * row, so a per-process count is visible rather than implied.\n */\nexport enum RateBudgetCounting {\n  SHARED = 'shared',\n  PROCESS = 'process',\n}\n\n/**\n * The defects of a connection's rate-budget declarations: a non-positive number, and a contract-level list beside\n * `oauth2.audiences` — which would apply to nothing, since every call of such a connection is on one audience. A pure\n * function so the registry refuses it at boot and a test pins it without a host.\n */\nexport function describeProviderRateBudgetDefects(input: {\n  readonly contractRateBudgets?: readonly ProviderRateBudgetDeclaration[];\n  readonly audiences?: Readonly<Record<string, { readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[] }>>;\n}): string[] {\n  const defects: string[] = [];\n  const check = (where: string, declarations: readonly ProviderRateBudgetDeclaration[] | undefined): void => {\n    for (const [index, declaration] of (declarations ?? []).entries()) {\n      if (!Number.isInteger(declaration.maxRequests) || declaration.maxRequests < 1) {\n        defects.push(`${where}[${index}].maxRequests must be a positive integer (got ${String(declaration.maxRequests)})`);\n      }\n      if (!Number.isFinite(declaration.windowSeconds) || declaration.windowSeconds <= 0) {\n        defects.push(`${where}[${index}].windowSeconds must be positive (got ${String(declaration.windowSeconds)})`);\n      }\n      if (!Object.values(ProviderRateBudgetPartition).includes(declaration.partition)) {\n        defects.push(`${where}[${index}].partition '${String(declaration.partition)}' is not a ProviderRateBudgetPartition`);\n      }\n    }\n  };\n  check('rest.rateBudgets', input.contractRateBudgets);\n  for (const [id, audience] of Object.entries(input.audiences ?? {})) check(`oauth2.audiences.${id}.rateBudgets`, audience.rateBudgets);\n  if ((input.contractRateBudgets?.length ?? 0) > 0 && Object.keys(input.audiences ?? {}).length > 0) {\n    defects.push('rest.rateBudgets is declared beside oauth2.audiences and would apply to no call — declare each limit on the audience it meters');\n  }\n  return defects;\n}\n\n/**\n * The declarations that apply to one call: the audience's own when the call's token is for an audience, else the\n * contract's. Nothing is inherited between the two — see {@link describeProviderRateBudgetDefects}.\n */\nexport function selectProviderRateBudgetDeclarations(input: {\n  readonly contractRateBudgets?: readonly ProviderRateBudgetDeclaration[];\n  readonly audience?: { readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[] };\n}): readonly ProviderRateBudgetDeclaration[] {\n  return input.audience !== undefined ? input.audience.rateBudgets ?? [] : input.contractRateBudgets ?? [];\n}\n/** @wildo_source:part:end external-connectors.models.connection-rate-budgets */\n\n\n/**\n * A provider whose credential is MINTED by an authorization-code exchange rather than pasted.\n *\n * Recorded because the source catalogues state it and nothing else does. 131 of the 699 transposed\n * vendors declare OAuth2, and their authorize URL, token URL and scopes exist nowhere in this\n * repository except the catalogue that was read — so extracting them and keeping them only in a\n * comment (which is what the transposer did until 2026-09-07) means the delegated-authorization lane\n * re-derives 131 vendors' endpoints by hand.\n *\n * ## What it does NOT change\n *\n * The wire placement. An OAuth2 access token rides in the same header as an API key —\n * `Authorization: Bearer …` — so `apiKey.headerName` and `apiKey.prefix` still describe the request,\n * and `apiKey.secretRef` still names the slot the credential is read from. What this block adds is\n * where that value COMES FROM: an exchange, per organization or per user, refreshable — rather than\n * an operator pasting a long-lived token into an environment variable.\n *\n * That distinction is the whole point. Without it a provider declares a static bearer key and, if an\n * operator happens to paste a long-lived token, WORKS — while advertising a credential model the\n * vendor does not offer, with no authorize step, no refresh and no per-tenant token. A wrong\n * configuration that works is worse than one that fails, because nothing surfaces it.\n *\n * The FLOW is not here and is not implied: connected accounts, the authorization round trip, refresh\n * and revocation are their own lane. This is the declaration that lane consumes.\n */\nexport interface ProviderRestOAuth2 {\n  /** Where the user is sent to grant access. Carries the vendor's own default scopes when it states them. */\n  readonly authorizeUrl: string;\n  /** Where an authorization code (or a refresh token) is exchanged for an access token. */\n  readonly tokenUrl: string;\n  /**\n   * Where a token is handed back to the vendor so the GRANT ends there too (#545).\n   *\n   * Deleting our copy of a token stops US using it. It does not stop the token working, and a\n   * refresh token frequently never expires on its own — so without this, \"Disconnect\" leaves the\n   * application listed in the person's own connected-apps screen at the vendor, and their belief\n   * that they have withdrawn access is not quite true.\n   *\n   * ## Why the field names RFC 7009 rather than \"revocation\"\n   *\n   * The name is the CONTRACT, not decoration. A URL here is POSTed\n   * `application/x-www-form-urlencoded` with a `token` parameter and an optional\n   * `token_type_hint`, and a 200 means the grant is gone — including for a token the server does\n   * not recognise.\n   * spec-cite: RFC 7009 §2.1 (revocation request) and §2.2 (revocation response), fetched\n   * 2026-09-18 — §2.2: *\"The authorization server responds with HTTP status code 200 if the token\n   * has been revoked successfully or if the client submitted an invalid token\"*, and *\"invalid\n   * tokens do not cause an error response since the client cannot handle such an error in a\n   * reasonable way.\"*\n   *\n   * That last sentence is why the caller is best-effort and never branches on the body: there is\n   * nothing to branch on.\n   *\n   * **A vendor whose revocation is NOT RFC 7009 declares nothing here, deliberately.** Slack's\n   * `auth.revoke` is a Web API method and GitHub's is `DELETE /applications/{client_id}/token` with\n   * basic auth and a JSON body; neither is expressible as this URL, and bending the field to fit\n   * them would make a declaration that names RFC 7009 and means something else entirely. Those vendors\n   * need a per-vendor revocation ACTION, which is a bigger surface and is not built on speculation —\n   * until then the honest answer is an absent field, and the disconnect surface says so.\n   *\n   * Absent — not empty — when no revocation is declared, so \"this vendor cannot be told\" stays\n   * distinguishable from \"nobody has looked\".\n   */\n  readonly rfc7009RevocationUrl?: string;\n  /**\n   * Scopes the vendor's own catalogue entry asked for. An application may request FEWER (a subset of\n   * these, once resolved), and an operation's `requiredScopes` is the finer statement. Kept because\n   * it is the only record of what the vendor expects for the operations transposed beside it.\n   *\n   * ## A scope may carry a placeholder, and it is resolved like an endpoint's (#991)\n   *\n   * Two shapes exist, classified by {@link classifyProviderOAuth2ScopePlaceholder}:\n   *\n   * - `{hostUrl}/.default` — the placeholder BEGINS the scope and is followed by `/`, so its value is\n   *   an ORIGIN (Microsoft Dataverse names the resource a token is minted FOR by the environment URL).\n   *   It is filled only within {@link endpointHostAllowances}, exactly like an origin in an endpoint:\n   *   a caller-chosen resource would have the vendor mint a token for a host nobody declared.\n   * - `{permissions}` — the placeholder IS the whole scope entry, and its value is one or more scope\n   *   tokens chosen from {@link scopeValueAllowances}. Such a value can itself name a resource\n   *   (`https://graph.microsoft.com/.default`), so it is a closed choice, never free text.\n   *\n   * Any other placement (`api://{x}`, `{a}{b}`, `{x}.default`) is refused as malformed.\n   */\n  readonly scopes?: readonly string[];\n  /**\n   * How this vendor lets an EXISTING grant grow by one permission (#1671) — declared by the provider module that\n   * owns the OAuth client, never guessed by the engine. See {@link ProviderOAuth2IncrementalConsent}.\n   *\n   * Absent means the vendor's behaviour is not recorded, so a re-authorization for a missing scope RESTATES what the\n   * grant already holds beside the addition: an ordinary authorization that replaces the previous one, which every\n   * RFC 6749 server honours. Declared, the re-authorization asks for the missing scope only and the stored granted\n   * set ACCUMULATES the previous consent with the new answer.\n   */\n  readonly incrementalConsent?: ProviderOAuth2IncrementalConsent;\n  /**\n   * Scopes a person cannot grant for themselves: only an administrator of the account can (#1671). Microsoft's\n   * application permissions and its admin-restricted delegated permissions are the case — \"Application permissions\n   * always require admin consent\", and a delegated permission that requires admin consent answers a user with \"an\n   * 'unauthorized to consent' error\".\n   * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — \"Admin Consent for\n   * Application permissions\" and \"Admin Consent for Delegated Permissions\", fetched 2026-09-27.\n   *\n   * Never put in a re-authorization request a person is sent to: an operation needing one is refused with the\n   * statement that an administrator must grant it, which is the only thing the person can act on.\n   */\n  readonly administratorConsentScopes?: readonly string[];\n  /**\n   * Env-var names resolving the APPLICATION's registration with the vendor. These are the two values\n   * an operator genuinely does paste — they identify the integration, not the end user — and they\n   * are separate from `apiKey.secretRef`, which names the minted access token.\n   */\n  readonly clientIdSecretRef?: string;\n  readonly clientSecretSecretRef?: string;\n  /**\n   * Placeholders the endpoints above carry, which a CONNECTION must answer before either URL is a\n   * URL at all — `{cloud}`, `{tenantId}`, `{region}`, `{domain}`. A PATH placeholder is answered freely;\n   * a HOST or ORIGIN one only from {@link ProviderRestOAuth2.endpointHostAllowances}.\n   *\n   * Re-measured over the generated catalogue on 2026-09-12: of the 99 vendors that recovered both\n   * endpoints, **20 carry at least one placeholder**, led by `{cloud}` (18 occurrences), `{location}`\n   * (10) and `{tenantId}` (6). Microsoft's authorize URL is\n   * `https://{cloud}/{tenantId}/oauth2/v2.0/authorize`, and no amount of application configuration\n   * supplies those: which Azure cloud and which directory are facts about the ACCOUNT BEING\n   * CONNECTED, known only to the person connecting it.\n   *\n   * So this is not decoration on the endpoint strings — it is the difference between a vendor that\n   * can be connected and one that cannot. Without it the flow would build\n   * `https://{cloud}/…/authorize`, send somebody to a hostname containing a brace, and fail in the\n   * browser rather than at the point where the missing input could have been asked for.\n   *\n   * DERIVED from the endpoint strings rather than authored, so a vendor whose URL gains a\n   * placeholder declares one the next time the batch runs. Absent — not empty — when the endpoints\n   * are plain, which is the common case and must stay distinguishable from \"nobody has looked\".\n   *\n   * Deliberately NOT a judgement about which connections a provider admits. That is a recorded\n   * decision in the catalogue record and is never read from a vendor's API surface; this is a\n   * mechanical fact about a string.\n   *\n   * A placeholder filled from {@link ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_BASE_URL} or\n   * {@link ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_CONFIGURED} is NOT listed: nobody\n   * connecting an account is asked for it, and a value they supply is refused.\n   *\n   * Derived from the {@link scopes} as well as the endpoints (#991): Dataverse's `{hostUrl}/.default`\n   * names a fact about the account (its environment URL) that no endpoint carries, and a placeholder\n   * only a scope mentions was otherwise never asked for — so the authorize request carried the literal\n   * brace to the vendor.\n   */\n  readonly connectionParameters?: readonly string[];\n  /**\n   * How each placeholder that forms an endpoint's HOST or ORIGIN may be filled, keyed by\n   * placeholder name. A host/origin placeholder with NO entry here cannot be filled at all, and the\n   * connect flow refuses it.\n   *\n   * ## Why this exists: the token endpoint receives the application's client secret\n   *\n   * The exchange POSTs `client_id` and the APPLICATION's `client_secret` to the resolved `tokenUrl`.\n   * Until 2026-09-12 every placeholder was answered from the connect-start request body, so where a\n   * placeholder formed the HOST — Microsoft's `https://{cloud}/…/token`, Salesforce's\n   * `https://{environment}/…`, Zoho's `https://accounts.{location}/…` — any user allowed to start a\n   * connection chose where that secret was sent (`cloud=attacker.tld`). Measured over the generated\n   * catalogue that day: 34 host-position occurrences across 17 vendors (9 Microsoft, 6 Zoho,\n   * Salesforce, Workday), plus two whole-origin\n   * placeholders (`gitea`, `bigin-by-zoho`) that were safe only because percent-encoding made them\n   * undialable (#623).\n   *\n   * So a host/origin value is chosen from what the PROVIDER declares, never from what a caller\n   * types. Path and query placeholders (`{tenantId}`, Workday's `{tenant}`) stay free and are\n   * percent-encoded, because an encoded path segment cannot move the request to another host.\n   *\n   * Derived by the transposer where the source catalogue states a closed choice (a dropdown), and\n   * otherwise taken from a recorded human decision in the catalogue record — never guessed.\n   *\n   * Also governs a placeholder that forms the ORIGIN of a SCOPE (`{hostUrl}/.default`, #991). One\n   * allow-list per placeholder name, wherever the name forms a host: a scope's resource URI decides\n   * which host the vendor mints the token for, which is the same question an endpoint's host answers.\n   */\n  readonly endpointHostAllowances?: Readonly<Record<string, ProviderOAuth2EndpointHostAllowance>>;\n  /**\n   * The closed set of values a WHOLE-SCOPE placeholder (`scopes: ['{permissions}']`) may be answered\n   * with, keyed by placeholder name (#991).\n   *\n   * Each value is substituted verbatim as that scope entry and may hold several space-delimited scope\n   * tokens — Microsoft Entra ID's permission presets are one such string each. Matched exactly, because\n   * scope values are case-sensitive.\n   * spec-cite: RFC 6749 §3.3 (the scope parameter is a list of space-delimited, case-sensitive strings).\n   *\n   * Closed rather than free because a scope value can itself name a resource\n   * (`https://graph.microsoft.com/.default`), and a whole-scope placeholder with NO entry here cannot be\n   * answered at all. Derived by the transposer from the source's own dropdown; never guessed.\n   */\n  readonly scopeValueAllowances?: Readonly<Record<string, ProviderOAuth2ScopeValueAllowance>>;\n  /**\n   * Dot-path, inside the TOKEN ENDPOINT'S JSON answer, to the vendor's own identifier for the account\n   * that was just authorized — Slack's `team.id` (#333).\n   *\n   * Read once, at the exchange, into the stored grant's `accountRef`, so a person holding two\n   * connections to one vendor can tell which is which and the grant audit names the account. Absent\n   * means the vendor reports no account identity in its token answer (Asana's names only the user).\n   *\n   * Identity only: nothing looks a credential up by it, and an answer that lacks the path stores the\n   * grant without it — a missing label is not a reason to discard an authorization the person just gave.\n   */\n  readonly accountRefResponsePath?: string;\n  /**\n   * Facts about the connected ACCOUNT that the vendor reports in its token answer and OPERATIONS consume,\n   * keyed by the fact's name (#333, #1047) — Salesforce's `instance_url`, Pipedrive's `api_domain`.\n   *\n   * Captured at the authorization-code exchange and again at every refresh, into the credential row's\n   * `connectionFacts` with provenance `REPORTED_BY_VENDOR`. Distinct from {@link accountRefResponsePath}:\n   * that is a LABEL a person reads, sealed in the grant; these are values requests are built from, kept\n   * client-readable beside the answers a person typed at connect.\n   *\n   * A fact that carries an `origin` allowance is an https ORIGIN operations may dial, so it decides where a\n   * request carrying the credential goes. It is therefore admitted exactly as an ORIGIN placeholder is\n   * ({@link endpointHostAllowances}): refused at connect when absent or outside the allowance, and\n   * re-checked on every call that uses it.\n   */\n  readonly reportedAccountFacts?: Readonly<Record<string, ProviderOAuth2ReportedAccountFact>>;\n  /**\n   * The RESOURCE AUDIENCES one grant of this client can mint tokens for, keyed by audience id (#1725), and the\n   * HOSTS a token of each may be sent to.\n   *\n   * ## Why a grant needs more than one access token\n   *\n   * Microsoft issues an access token for ONE resource per request: the token redemption's scopes \"must all be from a\n   * single resource\", and a refresh request spanning several resources returns \"a token for the resource specified\n   * in the first scope\". A refresh token, though, is not tied to a resource: \"A client can use a refresh token to\n   * acquire access tokens across any combination of resource and tenant where it has permission to do so.\" So a\n   * connection spanning Graph and Dataverse keeps ONE refresh token and mints a token per audience from it.\n   * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow — the `scope` rows\n   * of \"Redeem a code for an access token\" and \"Refresh the access token\"; and\n   * https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens — the opening section. Fetched 2026-09-27.\n   *\n   * ## Why the HOSTS are part of the declaration\n   *\n   * An access token is a bearer credential for its resource. Declaring which hosts receive a token of each audience is\n   * what lets the engine attach a token only to a request bound for its own resource (the token-host binding), so an\n   * operation — the base's own, a member's, or an augmentation's (#1672) — can never carry a Graph token to another\n   * host.\n   *\n   * Absent means the provider mints one token for one resource, which is every provider except a connection base that\n   * spans several. When present, {@link primaryAudience} names the audience the AUTHORIZATION grants — the resource of\n   * the connect request's scopes — whose token is the one stored with the grant; every other audience's token is minted\n   * from the refresh token on demand and cached, never stored.\n   */\n  readonly audiences?: Readonly<Record<string, ProviderRestOAuth2Audience>>;\n  /** The audience the authorization itself grants — see {@link audiences}. Required when `audiences` is declared. */\n  readonly primaryAudience?: string;\n}\n\n/** @wildo_source:part:start external-connectors.models.oauth2-audiences facet:layer:shared facet:family:provider facet:audience:app-developer */\n/** The placeholder a {@link ProviderRestOAuth2Audience.mintScopes} entry uses for the https origin of the request's host. */\nexport const PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER = '{audienceOrigin}';\n\n/** One resource audience of a connection's grant. See {@link ProviderRestOAuth2.audiences}. */\nexport interface ProviderRestOAuth2Audience {\n  /**\n   * The hosts a token of this audience may be sent to: exact lower-case hosts, and dotted suffixes admitting\n   * `<dns-labels><suffix>` (never the bare suffix). Every host is https.\n   */\n  readonly hosts: {\n    readonly values: readonly string[];\n    readonly hostSuffixes?: readonly string[];\n  };\n  /**\n   * The scopes that mint a token for this audience, all of ONE resource. An entry may begin with\n   * {@link PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER} — the https origin of the request's own host, admitted by\n   * {@link hosts} first — for a resource named per customer (a Dataverse environment's `<environment-url>/.default`).\n   */\n  readonly mintScopes: readonly string[];\n  /**\n   * The vendor's published limits for THIS resource (#1729) — see {@link ProviderRateBudgetDeclaration}. Per audience\n   * because each resource is metered by its own service: Graph's limits say nothing about a Dataverse environment.\n   */\n  readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[];\n}\n\n/** The audience a request host belongs to, with its id — see {@link selectProviderOAuth2AudienceForHost}. */\nexport interface ProviderOAuth2AudienceSelection {\n  readonly id: string;\n  readonly audience: ProviderRestOAuth2Audience;\n  readonly primary: boolean;\n}\n\n/** Whether `host` is admitted by one audience's hosts: an exact value, or `<labels><suffix>` for a declared suffix. */\nexport function providerOAuth2AudienceAdmitsHost(audience: ProviderRestOAuth2Audience, host: string): boolean {\n  const candidate = host.toLowerCase();\n  if (audience.hosts.values.some((value) => value.toLowerCase() === candidate)) return true;\n  return (audience.hosts.hostSuffixes ?? []).some((suffix) => {\n    const lowered = suffix.toLowerCase();\n    if (!candidate.endsWith(lowered) || candidate.length === lowered.length) return false;\n    return PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(candidate.slice(0, candidate.length - lowered.length));\n  });\n}\n\n/**\n * The ONE audience whose hosts admit `host`, or `undefined` when none does. The declaration guarantees at most one\n * ({@link describeProviderOAuth2AudienceDefects} refuses overlapping hosts), so the answer never depends on order.\n */\nexport function selectProviderOAuth2AudienceForHost(\n  oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience'>,\n  host: string,\n): ProviderOAuth2AudienceSelection | undefined {\n  for (const [id, audience] of Object.entries(oauth2.audiences ?? {})) {\n    if (providerOAuth2AudienceAdmitsHost(audience, host)) return { id, audience, primary: id === oauth2.primaryAudience };\n  }\n  return undefined;\n}\n\n/**\n * The scopes that mint `audience`'s token for a request to `origin` — `{audienceOrigin}` replaced by that origin.\n * The caller has already admitted the origin's host through {@link selectProviderOAuth2AudienceForHost}; nothing a\n * caller supplies reaches a scope any other way.\n */\nexport function resolveProviderOAuth2AudienceMintScopes(audience: ProviderRestOAuth2Audience, origin: string): readonly string[] {\n  return audience.mintScopes.map((scope) => (scope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER)\n    ? `${origin}${scope.slice(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER.length)}`\n    : scope));\n}\n\n/**\n * The declared audience a scope a connection might REQUEST names (#1671): its id, or `undefined` when the scope names a\n * resource none of the connection's audiences covers. Only meaningful when `audiences` is declared.\n *\n * A scope that is an absolute URI names the resource a token is minted for (`https://graph.microsoft.com/Mail.Send`,\n * `https://contoso.crm.dynamics.com/user_impersonation`): the resource of one of an audience's fixed mint scopes (the\n * mint scope without its last path segment), or — for a mint scope beginning `{audienceOrigin}` — an https origin whose\n * host the audience admits. A scope that is not an absolute URI (`offline_access`, `Files.Read`) names no resource, and\n * the vendor reads it against its default one, the PRIMARY audience: \"omitting the resource identifier in the `scope`\n * parameter defaults to Microsoft Graph\".\n * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — the note under\n * \"Admin Consent for Delegated Permissions\", fetched 2026-09-27.\n */\nexport function findProviderOAuth2ScopeAudience(\n  oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience'>,\n  scope: string,\n): string | undefined {\n  const audiences = oauth2.audiences ?? {};\n  if (!/^[a-z][a-z0-9+.-]*:\\/\\//i.test(scope)) return oauth2.primaryAudience;\n  // The https origin's host, read by the same shape the audiences declare (a DNS name, no port, no credentials) rather\n  // than by a URL parser: this package runs in a browser-neutral program with no URL global, and a scope that is not\n  // that shape names no host an audience could admit.\n  const origin = /^https:\\/\\/([^/?#:@]+)(?:\\/|$)/i.exec(scope);\n  const host = origin?.[1]?.toLowerCase();\n  for (const [id, audience] of Object.entries(audiences)) {\n    for (const mintScope of audience.mintScopes) {\n      if (mintScope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER)) {\n        if (host !== undefined && PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(host) && providerOAuth2AudienceAdmitsHost(audience, host)) return id;\n        continue;\n      }\n      const resource = mintScope.slice(0, mintScope.lastIndexOf('/'));\n      if (resource.length > 0 && scope.startsWith(`${resource}/`)) return id;\n    }\n  }\n  return undefined;\n}\n\n/**\n * Whether a scope a connection might REQUEST names a resource among the connection's declared audiences (#1671) — see\n * {@link findProviderOAuth2ScopeAudience}. Asking a person to consent to it is asking them to let this application reach\n * THAT resource, so a scope from a member ref or an opted-in augmentation (#1672) is requestable only when it names one\n * the connection declares. `true` without looking further when the connection declares no audiences: it mints one token\n * for one resource and its scopes are the vendor's own vocabulary (Google's scope URIs name permissions, not resources).\n */\nexport function providerOAuth2ScopeNamesDeclaredAudience(\n  oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience'>,\n  scope: string,\n): boolean {\n  if (oauth2.audiences === undefined) return true;\n  if (!/^[a-z][a-z0-9+.-]*:\\/\\//i.test(scope)) return true;\n  return findProviderOAuth2ScopeAudience(oauth2, scope) !== undefined;\n}\n/** @wildo_source:part:end external-connectors.models.oauth2-audiences */\n\n/** @wildo_source:part:start external-connectors.models.oauth2-incremental-consent facet:layer:shared facet:family:provider facet:audience:app-developer */\n/**\n * How a vendor extends an existing delegated grant with more scopes — see {@link ProviderRestOAuth2.incrementalConsent}.\n */\nexport enum ProviderOAuth2IncrementalConsentForm {\n  /**\n   * The vendor keeps what the person already consented to, and a new authorization request naming only the added\n   * scopes ADDS them: Microsoft's delegated permissions \"will be granted in addition to any other permissions that\n   * were already granted for that app (i.e. incremental)\".\n   * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — \"Incremental and\n   * dynamic user consent\", fetched 2026-09-27.\n   */\n  ADDITIVE = 'ADDITIVE',\n  /**\n   * The vendor adds the new scopes to the existing grant only when the request carries `include_granted_scopes=true`:\n   * \"If you set this parameter's value to `true` and the authorization request is granted, then the new access token\n   * will also cover any scopes to which the user previously granted the application access.\"\n   * spec-cite: https://developers.google.com/identity/protocols/oauth2/web-server#incrementalAuth — the\n   * `include_granted_scopes` parameter row, fetched 2026-09-27.\n   */\n  INCLUDE_GRANTED_SCOPES = 'INCLUDE_GRANTED_SCOPES',\n}\n\n/** A vendor's incremental-consent behaviour. See {@link ProviderRestOAuth2.incrementalConsent}. */\nexport interface ProviderOAuth2IncrementalConsent {\n  readonly form: ProviderOAuth2IncrementalConsentForm;\n  /**\n   * Scopes every re-authorization request repeats beside the added ones — protocol scopes the answer needs rather than\n   * permissions (Microsoft's `offline_access`, without which a code redemption returns no refresh token). Each must be\n   * among the provider's declared {@link ProviderRestOAuth2.scopes}.\n   */\n  readonly restatedScopes?: readonly string[];\n}\n/** @wildo_source:part:end external-connectors.models.oauth2-incremental-consent */\n\n/**\n * Why a declared audience set cannot be honoured, or an empty list. Checked where a provider is composed, so a\n * malformed declaration never reaches a request:\n * - `primaryAudience` names no declared audience, or is missing while audiences are declared;\n * - the primary audience's mint scopes are not among the authorization's own `scopes` (its token is the one the\n *   code redemption returns, so the authorization must be FOR that resource) or use the origin placeholder;\n * - an audience with no host or no mint scope, a suffix without a leading dot, an origin placeholder anywhere but\n *   the start of a scope, or any other `{placeholder}` in a mint scope;\n * - two audiences admitting one host — a request host must select exactly one token.\n */\nexport function describeProviderOAuth2AudienceDefects(oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience' | 'scopes'>): string[] {\n  const audiences = oauth2.audiences;\n  if (audiences === undefined) {\n    return oauth2.primaryAudience === undefined ? [] : [`primaryAudience '${oauth2.primaryAudience}' is declared with no audiences`];\n  }\n  const defects: string[] = [];\n  const primary = oauth2.primaryAudience === undefined ? undefined : audiences[oauth2.primaryAudience];\n  if (primary === undefined) defects.push(`primaryAudience '${String(oauth2.primaryAudience)}' names no declared audience`);\n  for (const [id, audience] of Object.entries(audiences)) {\n    if (audience.hosts.values.length === 0 && (audience.hosts.hostSuffixes ?? []).length === 0) defects.push(`audience '${id}' admits no host`);\n    for (const suffix of audience.hosts.hostSuffixes ?? []) {\n      if (!suffix.startsWith('.') || !PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(suffix.slice(1).toLowerCase())) defects.push(`audience '${id}' declares the host suffix '${suffix}', which is not '.<dns-name>'`);\n    }\n    for (const value of audience.hosts.values) {\n      if (!PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(value.toLowerCase())) defects.push(`audience '${id}' declares the host '${value}', which is not a DNS name`);\n    }\n    if (audience.mintScopes.length === 0) defects.push(`audience '${id}' declares no mint scope`);\n    for (const scope of audience.mintScopes) {\n      const rest = scope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER) ? scope.slice(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER.length) : scope;\n      if (rest.includes('{') || rest.includes('}')) defects.push(`audience '${id}' mint scope '${scope}' carries a placeholder other than a leading ${PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER}`);\n    }\n  }\n  if (primary !== undefined) {\n    for (const scope of primary.mintScopes) {\n      if (scope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER)) defects.push(`the primary audience '${oauth2.primaryAudience}' mint scope '${scope}' names a per-request origin; the authorization must be for one fixed resource`);\n      else if (!(oauth2.scopes ?? []).includes(scope)) defects.push(`the primary audience '${oauth2.primaryAudience}' mint scope '${scope}' is not among the authorization's own scopes`);\n    }\n  }\n  const entries = Object.entries(audiences);\n  for (let left = 0; left < entries.length; left += 1) {\n    for (let right = left + 1; right < entries.length; right += 1) {\n      const [leftId, leftAudience] = entries[left]!;\n      const [rightId, rightAudience] = entries[right]!;\n      const overlap = leftAudience.hosts.values.some((host) => providerOAuth2AudienceAdmitsHost(rightAudience, host))\n        || rightAudience.hosts.values.some((host) => providerOAuth2AudienceAdmitsHost(leftAudience, host))\n        || (leftAudience.hosts.hostSuffixes ?? []).some((suffix) => (rightAudience.hosts.hostSuffixes ?? []).some((other) => suffix.toLowerCase().endsWith(other.toLowerCase()) || other.toLowerCase().endsWith(suffix.toLowerCase())));\n      if (overlap) defects.push(`audiences '${leftId}' and '${rightId}' admit a common host; a request host must select one token`);\n    }\n  }\n  return defects;\n}\n\n/** One vendor-reported account fact. See {@link ProviderRestOAuth2.reportedAccountFacts}. */\nexport interface ProviderOAuth2ReportedAccountFact {\n  /** Dot-path inside the token endpoint's JSON answer. A string or finite number there is the value. */\n  readonly responsePath: string;\n  /**\n   * Present when the value is an https ORIGIN operations dial. The same DECLARED_VALUES vocabulary an\n   * ORIGIN placeholder uses: exact origins, or `https://<dns-labels><suffix>` for each dotted suffix.\n   */\n  readonly origin?: Extract<ProviderOAuth2EndpointHostAllowance, { readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DECLARED_VALUES }>;\n}\n\n/** The values a whole-scope placeholder admits. See {@link ProviderRestOAuth2.scopeValueAllowances}. */\nexport interface ProviderOAuth2ScopeValueAllowance {\n  readonly values: readonly string[];\n  /** Values the vendor's source offers and the catalogue declines, matched exactly. See {@link ProviderOAuth2UnsupportedValues}. */\n  readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;\n}\n\n/**\n * Values the vendor's OWN source offers for a placeholder and this catalogue deliberately does NOT admit, each mapped\n * to the reason (#1937). Keyed by the value as the source writes it.\n *\n * Not a second allow-list: the admitted set (`values`, `hosts`) alone decides what is admitted, and a value found\n * here is refused exactly as any other unadmitted value is (`VALUE_NOT_ADMITTED`, which also retires a STORED\n * connection that carries it). What this adds is the WHY. A person who chose, or a connection that stored, a value\n * the catalogue declined is told that it is unsupported and for what reason, instead of being handed a list of other\n * values as though they had made a typing mistake.\n *\n * The first entry is the US Government Microsoft clouds (`login.microsoftonline.us`, GCC High and DoD), declared out\n * of scope by product decision on 2026-09-29. The transposer writes these from the vendor record's declared\n * exclusion (`_code_archive/providers/catalogue-record/vendors/<vendor>.json` since #2019 archived the catalogue; a\n * registry provider adopted from it states them in its own module under `providers-registry/<ref>/`), so reversing a\n * decision is record edits and a regeneration, never an engine change. How many edits depends on what the decline also removed: for the US\n * Government clouds, three (the catalogue README lists them).\n */\nexport type ProviderOAuth2UnsupportedValues = Readonly<Record<string, string>>;\n\n/** How a placeholder's value is compared with a declared one. */\nexport enum ProviderOAuth2ValueComparison {\n  /** A host or an origin: DNS names compare case-insensitively. spec-cite: RFC 4343 §2. */\n  CASE_INSENSITIVE = 'CASE_INSENSITIVE',\n  /** A scope value: scope strings are case-sensitive. spec-cite: RFC 6749 §3.3. */\n  EXACT = 'EXACT',\n}\n\n/**\n * The declared reason a value is unsupported, or `undefined` when it is not declared unsupported. Compared as the\n * placeholder's values are: case-insensitively for a host or origin, exactly for a scope value.\n */\nexport function findProviderOAuth2UnsupportedValueReason(\n  unsupportedValues: ProviderOAuth2UnsupportedValues | undefined,\n  value: string,\n  comparison: ProviderOAuth2ValueComparison,\n): string | undefined {\n  if (unsupportedValues === undefined) return undefined;\n  const key = comparison === ProviderOAuth2ValueComparison.EXACT\n    ? (Object.hasOwn(unsupportedValues, value) ? value : undefined)\n    : Object.keys(unsupportedValues).find((candidate) => candidate.toLowerCase() === value.toLowerCase());\n  return key === undefined ? undefined : unsupportedValues[key];\n}\n\n/**\n * Why a declared unsupported-value map contradicts the admitted set it sits beside, or an empty list: a value both\n * admitted and declined would make the refusal reason a lie, and a declined value with no reason says nothing.\n */\nfunction describeProviderOAuth2UnsupportedValueDefects(\n  unsupportedValues: ProviderOAuth2UnsupportedValues | undefined,\n  admitted: readonly string[],\n  comparison: ProviderOAuth2ValueComparison,\n): readonly string[] {\n  if (unsupportedValues === undefined) return [];\n  const defects: string[] = [];\n  const normalise = (value: string): string => (comparison === ProviderOAuth2ValueComparison.EXACT ? value : value.toLowerCase());\n  const admittedSet = new Set(admitted.map(normalise));\n  for (const [value, reason] of Object.entries(unsupportedValues)) {\n    if (admittedSet.has(normalise(value))) defects.push(`'${value}' is both admitted and declared unsupported`);\n    if (typeof reason !== 'string' || reason.trim() === '') defects.push(`unsupported value '${value}' states no reason`);\n  }\n  return defects;\n}\n\n/**\n * Where a `{placeholder}` sits inside one OAuth2 SCOPE entry. See {@link classifyProviderOAuth2ScopePlaceholder}.\n *\n * Deliberately not {@link ProviderOAuth2EndpointPlaceholderPosition}: a scope is not a URL, and the\n * endpoint scan would call `{permissions}` an ORIGIN (it begins the string and nothing follows it).\n */\nexport enum ProviderOAuth2ScopePlaceholderPosition {\n  /**\n   * The placeholder begins the scope and is followed by `/` — `{hostUrl}/.default`. Its value is an\n   * https ORIGIN, admitted only within {@link ProviderRestOAuth2.endpointHostAllowances}.\n   */\n  ORIGIN = 'ORIGIN',\n  /**\n   * The placeholder is the entire scope entry — `{permissions}`. Its value is one of\n   * {@link ProviderRestOAuth2.scopeValueAllowances}.\n   */\n  WHOLE_SCOPE = 'WHOLE_SCOPE',\n}\n\n/** Why a scope entry cannot be resolved safely, whatever is supplied. See {@link findProviderOAuth2ScopeTemplateDefects}. */\nexport enum ProviderOAuth2ScopeTemplateDefect {\n  /**\n   * A placeholder sits anywhere except at the start of the scope followed by `/` or the end —\n   * `api://{x}/.default`, `{x}.default`, `openid {x}`. Such a value would be concatenated with text\n   * around it into a resource or scope nobody declared.\n   */\n  UNSUPPORTED_PLACEHOLDER_POSITION = 'UNSUPPORTED_PLACEHOLDER_POSITION',\n  /** More than one placeholder in one scope entry: each value validated alone can compose an undeclared one. */\n  SEVERAL_PLACEHOLDERS = 'SEVERAL_PLACEHOLDERS',\n  /** A `{` or `}` that is not part of a well-formed placeholder: a vendor can never grant a scope carrying one. */\n  STRAY_BRACE = 'STRAY_BRACE',\n}\n\n/** One `{placeholder}` in a scope entry. */\nexport interface ProviderOAuth2ScopePlaceholderOccurrence {\n  readonly name: string;\n  readonly position: ProviderOAuth2ScopePlaceholderPosition;\n  /** The whole `{name}` token, for substitution. */\n  readonly token: string;\n}\n\n/**\n * The defects that make a scope entry unsafe to resolve, or an empty list. Shared by the runtime (which\n * refuses) and the transposer (which refuses to emit), so neither admits a shape the other rejects.\n */\nexport function findProviderOAuth2ScopeTemplateDefects(scope: string): readonly ProviderOAuth2ScopeTemplateDefect[] {\n  const occurrences = [...scope.matchAll(PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN)];\n  const withoutPlaceholders = scope.replace(PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN, '');\n  const defects: ProviderOAuth2ScopeTemplateDefect[] = [];\n  if (withoutPlaceholders.includes('{') || withoutPlaceholders.includes('}')) defects.push(ProviderOAuth2ScopeTemplateDefect.STRAY_BRACE);\n  if (occurrences.length > 1) defects.push(ProviderOAuth2ScopeTemplateDefect.SEVERAL_PLACEHOLDERS);\n  const first = occurrences[0];\n  if (first !== undefined) {\n    const next = scope.charAt((first.index ?? 0) + first[0].length);\n    if ((first.index ?? 0) !== 0 || (next !== '' && next !== '/')) defects.push(ProviderOAuth2ScopeTemplateDefect.UNSUPPORTED_PLACEHOLDER_POSITION);\n  }\n  return defects;\n}\n\n/**\n * Classify the one placeholder a scope entry may carry, or `undefined` when it carries none.\n *\n * ONE function, shared by the transposer and the runtime, like its endpoint counterpart. Meaningful only\n * for a scope with no {@link findProviderOAuth2ScopeTemplateDefects}; every consumer refuses those first.\n */\nexport function classifyProviderOAuth2ScopePlaceholder(scope: string): ProviderOAuth2ScopePlaceholderOccurrence | undefined {\n  const match = /^\\{([A-Za-z_][A-Za-z0-9_]*)\\}/.exec(scope);\n  if (match === null) return undefined;\n  return {\n    name: match[1]!,\n    position: match[0].length === scope.length ? ProviderOAuth2ScopePlaceholderPosition.WHOLE_SCOPE : ProviderOAuth2ScopePlaceholderPosition.ORIGIN,\n    token: match[0],\n  };\n}\n\n/**\n * One scope token: printable ASCII except space, `\"` and backslash.\n * spec-cite: RFC 6749 §3.3 (scope-token = 1*( %x21 / %x23-5B / %x5D-7E )).\n * Braces are additionally refused: a value carrying one would read as a placeholder nobody resolves.\n */\nconst PROVIDER_OAUTH2_SCOPE_TOKEN_PATTERN = /^[\\x21\\x23-\\x5B\\x5D-\\x7A\\x7C\\x7E]+$/;\n\n/**\n * Why a declared whole-scope allowance cannot be applied, or an empty list. Enforced at generation so a\n * broken set refuses the batch; the runtime matches exactly and never trusts a value it did not declare.\n */\nexport function describeProviderOAuth2ScopeValueAllowanceDefects(allowance: ProviderOAuth2ScopeValueAllowance): readonly string[] {\n  const defects: string[] = [];\n  if (!Array.isArray(allowance.values) || allowance.values.length === 0) return ['a scope value allowance admits nothing'];\n  for (const value of allowance.values) {\n    const tokens = typeof value === 'string' ? value.split(' ') : [];\n    if (typeof value !== 'string' || value.length === 0 || !tokens.every((token) => PROVIDER_OAUTH2_SCOPE_TOKEN_PATTERN.test(token))) {\n      defects.push(`'${String(value)}' is not a space-delimited list of scope tokens`);\n    }\n  }\n  defects.push(...describeProviderOAuth2UnsupportedValueDefects(allowance.unsupportedValues, allowance.values, ProviderOAuth2ValueComparison.EXACT));\n  return defects;\n}\n\n/**\n * Where a `{placeholder}` sits inside an OAuth2 endpoint template — the classification the host\n * allow-list keys on. See {@link classifyProviderOAuth2EndpointPlaceholders}.\n */\nexport enum ProviderOAuth2EndpointPlaceholderPosition {\n  /**\n   * The placeholder BEGINS the template, so its value is the whole scheme + authority (+ any path\n   * prefix): `{baseUrl}/login/oauth/authorize`. The most dangerous position — the value names the\n   * scheme as well as the host.\n   */\n  ORIGIN = 'ORIGIN',\n  /**\n   * The placeholder sits between `://` and the first `/`, `?` or `#` after it:\n   * `https://{cloud}/common/…`, `https://accounts.{location}/…`. Its value decides which host\n   * receives the request.\n   */\n  HOST = 'HOST',\n  /** Anywhere after the authority. Percent-encoded, so it cannot move the request to another host. */\n  PATH_OR_QUERY = 'PATH_OR_QUERY',\n}\n\n/** How a host- or origin-forming placeholder may be filled. See {@link ProviderRestOAuth2.endpointHostAllowances}. */\nexport enum ProviderOAuth2EndpointHostAllowanceKind {\n  /**\n   * Chosen at connect time from values the provider DECLARES — Microsoft's commercial login cloud,\n   * Zoho's data centres. A value outside the set is refused; a declared value is substituted\n   * verbatim (it is a hostname or origin, not a path segment to encode).\n   *\n   * `hostSuffixes` additionally admits `<dns-label>(.<dns-label>)*` followed by one of the suffixes,\n   * for a vendor whose per-customer host is a subdomain it controls (Salesforce My Domain,\n   * `<name>.my.salesforce.com`). On a HOST placeholder a suffix applies only when the placeholder is\n   * the WHOLE host. On an ORIGIN placeholder it admits exactly `https://<dns-labels><suffix>` — the\n   * scheme fixed to https, no port, path, userinfo, query or fragment — which is what a per-customer\n   * origin such as a Dataverse environment URL (`https://<org>.crm4.dynamics.com`, #991) needs.\n   */\n  DECLARED_VALUES = 'DECLARED_VALUES',\n  /**\n   * Filled from the DEPLOYMENT's configured base URL for this provider — the REST contract's\n   * `baseUrl`, or the environment variable its `baseUrlEnvVarName` names. For a self-hosted vendor\n   * (Gitea) the operator names the instance once; a person connecting an account is never asked, and\n   * a value they supply is refused. Admitted in the ORIGIN position only.\n   */\n  DEPLOYMENT_BASE_URL = 'DEPLOYMENT_BASE_URL',\n  /**\n   * Filled from a deployment environment variable dedicated to THIS placeholder, named by the\n   * allowance's `envVarName` (#992). For a vendor whose endpoints sit on more than one per-tenant host\n   * — Workday's `https://{authHost}/…/authorize` and `https://{apiHost}/…/token` — one base URL cannot\n   * name both, so each host is its own operator setting (`WORKDAY_AUTH_HOST`, `WORKDAY_API_HOST`).\n   *\n   * Like DEPLOYMENT_BASE_URL, never asked of a person connecting, and a value they supply is refused.\n   * The trade is explicit: the application serves the one vendor tenant (data centre) the operator\n   * names. Admitted on a HOST placeholder that is the whole host, with a DNS-name value.\n   */\n  DEPLOYMENT_CONFIGURED = 'DEPLOYMENT_CONFIGURED',\n  /**\n   * DERIVED from another connect-time answer through a declared table (#1937): Microsoft Graph's operation host follows\n   * the login cloud the connection chose (`login.microsoftonline.com` → `graph.microsoft.com`), because a token minted by\n   * one national cloud is not accepted by another. The Microsoft source also maps the US Government login cloud; that\n   * row is declined (`unsupportedValues`), because US Government clouds are out of scope (decision of 2026-09-29).\n   *\n   * Never asked of a person and never taken from a request: the value is looked up from the ANSWER the connection\n   * stored for `answer`, and an answer the table does not name is refused. `whenUnanswered` is the host for a connection\n   * that answered nothing (the application's own pasted credential); absent, such a connection is refused. The table is\n   * the allow-list, so no other host can result. Admitted on a HOST placeholder that is the whole host.\n   *\n   * spec-cite: https://learn.microsoft.com/en-us/graph/deployments — \"Access tokens acquired for a national cloud\n   * deployment are not interchangeable with those acquired for the global service or any other national cloud.\"\n   */\n  DERIVED_FROM_CONNECTION_ANSWER = 'DERIVED_FROM_CONNECTION_ANSWER',\n}\n\nexport type ProviderOAuth2EndpointHostAllowance =\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DECLARED_VALUES;\n    /** Exact admitted values, compared case-insensitively. A hostname for HOST, an origin for ORIGIN. */\n    readonly values: readonly string[];\n    /**\n     * A whole HOST, or an ORIGIN (admitting `https://<labels><suffix>` only). Each MUST begin with `.`,\n     * so `evilmy.salesforce.com` never matches `.my.salesforce.com`.\n     */\n    readonly hostSuffixes?: readonly string[];\n    /**\n     * ORIGIN only: an admitted value must ALSO have the same origin as the deployment's configured base\n     * URL (the REST contract's `baseUrl` / `baseUrlEnvVarName`) (#991 review F4).\n     *\n     * For a vendor whose token is minted for a per-customer environment and whose operations dial the\n     * operator's configured instance — Dataverse mints for the scope's `{hostUrl}` while operations go to\n     * `MICROSOFT_DYNAMICS_CRM_BASE_URL` — a connection naming another environment would hold a token that\n     * fails every call. So the two are required to agree at connect, and an unset base URL refuses the\n     * connect as a deployment gap rather than minting a token nothing can use.\n     */\n    readonly originMatchesDeploymentBaseUrl?: true;\n    /** Values the vendor's source offers and the catalogue declines, with the reason. See {@link ProviderOAuth2UnsupportedValues}. */\n    readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;\n  }\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_CONFIGURED;\n    /**\n     * The deployment environment variable holding the host — derived by the transposer as\n     * `<PROVIDER_ENV_PREFIX>_<PLACEHOLDER_IN_SCREAMING_SNAKE>` and declared as a REGISTRATION secret slot,\n     * without which the runtime environment builder would strip it.\n     */\n    readonly envVarName: string;\n  }\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DERIVED_FROM_CONNECTION_ANSWER;\n    /** The connect-time answer the host is derived from (`cloud`) — itself a placeholder of the same provider. */\n    readonly answer: string;\n    /** Per answer value (compared case-insensitively), the host it selects. DNS names. */\n    readonly hosts: Readonly<Record<string, string>>;\n    /** The host when the connection answered nothing; absent, an unanswered connection is refused. */\n    readonly whenUnanswered?: string;\n    /**\n     * ANSWER values the vendor's source maps to a host and the catalogue declines, with the reason — so a stored\n     * connection carrying one is refused at use naming why. See {@link ProviderOAuth2UnsupportedValues}.\n     */\n    readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;\n  }\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_BASE_URL;\n    /**\n     * A path the configured base URL carries and the OAuth2 endpoints do NOT — stripped before\n     * substitution, and REQUIRED to be present. Gitea's operation base is `<instance>/api/v1` while\n     * its OAuth2 endpoints hang off `<instance>`; stripping keeps an instance served under a sub-path\n     * correct, where taking only the origin would drop it.\n     */\n    readonly baseUrlPathSuffix?: string;\n  };\n\n/** One `{placeholder}` occurrence in an OAuth2 endpoint template. */\nexport interface ProviderOAuth2EndpointPlaceholderOccurrence {\n  readonly name: string;\n  readonly position: ProviderOAuth2EndpointPlaceholderPosition;\n  /** Offset of the opening brace in the template. */\n  readonly index: number;\n  /** The whole `{name}` token, for substitution. */\n  readonly token: string;\n  /**\n   * HOST only: the token is the ENTIRE authority (`https://{cloud}/…`), as opposed to one part of it\n   * (`https://accounts.{location}/…`). A declared host SUFFIX is only meaningful for a whole host — on a\n   * partial one it would be concatenated with the text around it and admit a host nobody declared.\n   */\n  readonly occupiesWholeHost: boolean;\n  /**\n   * HOST only: when the token OPENS the authority and is followed by literal text up to the end of the authority —\n   * `https://{subdomain}.zendesk.com/…` → `.zendesk.com` — that literal text (#1015). A declared host SUFFIX equal to it\n   * bounds the composed host exactly as it bounds a whole host: the value is DNS labels, the template's own literal\n   * supplies the suffix, and `<labels>.zendesk.com` is the only shape that can result. Absent for a whole host, for a\n   * token that does not open the host (`accounts.{location}`), and for an ORIGIN or PATH token.\n   */\n  readonly literalHostSuffix?: string;\n}\n\n/**\n * Why an OAuth2 endpoint TEMPLATE cannot be resolved safely, whatever values are supplied.\n * See {@link findProviderOAuth2EndpointTemplateDefects}.\n */\nexport enum ProviderOAuth2EndpointTemplateDefect {\n  /**\n   * The template neither begins `http://` / `https://` nor begins with a placeholder. The WHATWG URL\n   * parser reads `https:/{h}/t`, `https:{h}/t` and `https:` + two backslashes + `{h}/t` as `https://h/t`, so a string scan\n   * for `://` would call `{h}` a PATH placeholder, encode it (a hostname survives encoding untouched),\n   * and send the request — and the client secret — to whatever a caller typed.\n   */\n  NOT_AN_ABSOLUTE_TEMPLATE = 'NOT_AN_ABSOLUTE_TEMPLATE',\n  /**\n   * An ORIGIN placeholder is followed by something other than `/`, `?`, `#` or the end —\n   * `{baseUrl}.evil.test/…`, `{baseUrl}:8443/…`, `{a}{b}/…`. The text after it would extend the host\n   * the origin value names.\n   */\n  ORIGIN_NOT_TERMINATED = 'ORIGIN_NOT_TERMINATED',\n  /**\n   * One authority carries more than one placeholder (`https://{a}{b}/…`, `https://{sub}.{domain}/…`).\n   * Each value validated alone can still compose a host no declaration admits.\n   */\n  SEVERAL_PLACEHOLDERS_IN_AUTHORITY = 'SEVERAL_PLACEHOLDERS_IN_AUTHORITY',\n  /**\n   * The authority after `://` is empty, begins with `/` or a backslash, or carries a backslash or `@`\n   * before the first `/`, `?` or `#`. The parser skips extra slashes (`https:///{h}/t` dials `{h}` as the\n   * HOST, while the `://` scan sees an empty authority and calls `{h}` a PATH), reads a backslash as a\n   * path separator, and\n   * reads text before `@` as userinfo — each makes the scan and the parser disagree about the host.\n   */\n  MALFORMED_AUTHORITY = 'MALFORMED_AUTHORITY',\n}\n\n/**\n * A DNS name: one or more LDH labels, lower-case (callers lower-case first).\n * spec-cite: RFC 1123 §2.1 (a label may begin with a digit) and RFC 1035 §2.3.1 (letters, digits,\n * hyphen; 63 octets per label).\n */\nexport const PROVIDER_OAUTH2_DNS_NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;\n\n/**\n * Why a DECLARED host allowance cannot be applied where its placeholder sits — the position rules the\n * transposer enforces at GENERATION time, so a broken declaration refuses the batch instead of being\n * emitted and refused at every connect. Empty when the allowance is sound.\n *\n * The runtime resolver refuses each of these too; this exists so they are caught where a human is\n * already looking at a diff rather than where a person is pressing Connect.\n */\nexport function describeProviderOAuth2EndpointHostAllowanceDefects(\n  placeholder: { readonly position: ProviderOAuth2EndpointPlaceholderPosition; readonly occupiesWholeHost: boolean; readonly literalHostSuffix?: string },\n  allowance: ProviderOAuth2EndpointHostAllowance,\n): readonly string[] {\n  const defects: string[] = [];\n  if (placeholder.position === ProviderOAuth2EndpointPlaceholderPosition.PATH_OR_QUERY) {\n    return ['a PATH or QUERY placeholder takes no host allowance'];\n  }\n  if (allowance.kind === ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_BASE_URL) {\n    if (placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.ORIGIN) {\n      defects.push('DEPLOYMENT_BASE_URL fills an ORIGIN only, and this placeholder does not begin its endpoint');\n    }\n    if (allowance.baseUrlPathSuffix !== undefined && !/^\\/[^?#]*[^/?#]$/.test(allowance.baseUrlPathSuffix)) {\n      defects.push(`baseUrlPathSuffix '${allowance.baseUrlPathSuffix}' must begin with '/' and name a path (no trailing '/', query or fragment)`);\n    }\n    return defects;\n  }\n  if (allowance.kind === ProviderOAuth2EndpointHostAllowanceKind.DERIVED_FROM_CONNECTION_ANSWER) {\n    if (placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.HOST || !placeholder.occupiesWholeHost) {\n      defects.push('DERIVED_FROM_CONNECTION_ANSWER fills a WHOLE HOST only, and this placeholder is not one');\n    }\n    if (typeof allowance.answer !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(allowance.answer)) {\n      defects.push(`answer '${String(allowance.answer)}' is not a placeholder name`);\n    }\n    const hosts = Object.values(allowance.hosts ?? {});\n    if (hosts.length === 0) defects.push('DERIVED_FROM_CONNECTION_ANSWER maps no answer to a host, which admits nothing');\n    for (const host of [...hosts, ...(allowance.whenUnanswered === undefined ? [] : [allowance.whenUnanswered])]) {\n      if (typeof host !== 'string' || !PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(host.toLowerCase())) defects.push(`'${String(host)}' is not a DNS name`);\n    }\n    defects.push(...describeProviderOAuth2UnsupportedValueDefects(allowance.unsupportedValues, Object.keys(allowance.hosts ?? {}), ProviderOAuth2ValueComparison.CASE_INSENSITIVE));\n    return defects;\n  }\n  if (allowance.kind === ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_CONFIGURED) {\n    if (placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.HOST || !placeholder.occupiesWholeHost) {\n      defects.push('DEPLOYMENT_CONFIGURED fills a WHOLE HOST only, and this placeholder is not one');\n    }\n    if (typeof allowance.envVarName !== 'string' || !/^[A-Z][A-Z0-9_]*$/.test(allowance.envVarName)) {\n      defects.push(`envVarName '${String(allowance.envVarName)}' is not an upper-case environment variable name`);\n    }\n    return defects;\n  }\n  if (allowance.originMatchesDeploymentBaseUrl === true && placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.ORIGIN) {\n    defects.push('originMatchesDeploymentBaseUrl applies to an ORIGIN only, and this placeholder is not one');\n  }\n  if (allowance.values.length === 0 && (allowance.hostSuffixes ?? []).length === 0) {\n    defects.push('DECLARED_VALUES admits nothing');\n  }\n  for (const value of allowance.values) {\n    if (placeholder.position === ProviderOAuth2EndpointPlaceholderPosition.ORIGIN) {\n      // Matched as text, not with `URL`: this package compiles without a DOM or Node lib. A lower-case\n      // `https://` + DNS name, with nothing after the host but an optional port, is exactly an origin as\n      // `URL#origin` would print it back.\n      const match = /^https:\\/\\/([^:/?#@]+)(?::\\d{1,5})?$/.exec(value);\n      if (match === null || !PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(match[1]!)) {\n        defects.push(`'${value}' is not an https origin (scheme and lower-case host only)`);\n      }\n    } else if (!PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(value.toLowerCase())) {\n      defects.push(`'${value}' is not a DNS name`);\n    }\n  }\n  for (const suffix of allowance.hostSuffixes ?? []) {\n    // An ORIGIN is a whole authority by construction (the scheme is then fixed to https); a HOST\n    // placeholder qualifies only when nothing surrounds it inside the authority.\n    // A placeholder that OPENS the host qualifies too, but only for the ONE suffix the template itself writes after\n    // it (#1015): any other suffix would be concatenated with that literal into a host nobody declared.\n    const opensHostWithThisSuffix = placeholder.literalHostSuffix !== undefined && placeholder.literalHostSuffix.toLowerCase() === suffix.toLowerCase();\n    if (placeholder.position === ProviderOAuth2EndpointPlaceholderPosition.HOST && !placeholder.occupiesWholeHost && !opensHostWithThisSuffix) {\n      defects.push(`host suffix '${suffix}' on a placeholder that is not the whole host`);\n      continue;\n    }\n    const labels = suffix.startsWith('.') ? suffix.slice(1) : '';\n    if (!PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(labels.toLowerCase()) || !labels.includes('.')) {\n      defects.push(`host suffix '${suffix}' must begin with '.' and name at least two DNS labels (a bare '.com' admits every host under a TLD)`);\n    }\n  }\n  defects.push(...describeProviderOAuth2UnsupportedValueDefects(allowance.unsupportedValues, allowance.values, ProviderOAuth2ValueComparison.CASE_INSENSITIVE));\n  for (const declined of Object.keys(allowance.unsupportedValues ?? {})) {\n    // A declined value a declared SUFFIX would still admit is admitted, whatever the reason says.\n    const coveringSuffix = (allowance.hostSuffixes ?? []).find((suffix) => declined.toLowerCase().endsWith(suffix.toLowerCase()));\n    if (coveringSuffix !== undefined) defects.push(`'${declined}' is declared unsupported but the host suffix '${coveringSuffix}' admits it`);\n  }\n  return defects;\n}\n\n/**\n * The defects that make a template unsafe to resolve, or an empty list. Shared by the runtime (which\n * refuses) and the transposer (which refuses to emit), so neither can admit a shape the other rejects.\n */\nexport function findProviderOAuth2EndpointTemplateDefects(template: string): readonly ProviderOAuth2EndpointTemplateDefect[] {\n  const defects: ProviderOAuth2EndpointTemplateDefect[] = [];\n  const leadingPlaceholder = /^\\{[A-Za-z_][A-Za-z0-9_]*\\}/.exec(template);\n  if (!/^https?:\\/\\//i.test(template) && leadingPlaceholder === null) {\n    return [ProviderOAuth2EndpointTemplateDefect.NOT_AN_ABSOLUTE_TEMPLATE];\n  }\n  if (leadingPlaceholder !== null) {\n    const next = template.charAt(leadingPlaceholder[0].length);\n    if (next !== '' && next !== '/' && next !== '?' && next !== '#') defects.push(ProviderOAuth2EndpointTemplateDefect.ORIGIN_NOT_TERMINATED);\n  } else {\n    const afterScheme = template.slice(template.indexOf('://') + 3);\n    const authorityEnd = afterScheme.search(/[/?#]/);\n    const authority = authorityEnd < 0 ? afterScheme : afterScheme.slice(0, authorityEnd);\n    if (authority === '' || authority.includes('\\\\') || authority.includes('@')) {\n      defects.push(ProviderOAuth2EndpointTemplateDefect.MALFORMED_AUTHORITY);\n      return defects;\n    }\n    const hostPlaceholders = classifyProviderOAuth2EndpointPlaceholders(template)\n      .filter((occurrence) => occurrence.position === ProviderOAuth2EndpointPlaceholderPosition.HOST);\n    if (hostPlaceholders.length > 1) defects.push(ProviderOAuth2EndpointTemplateDefect.SEVERAL_PLACEHOLDERS_IN_AUTHORITY);\n  }\n  return defects;\n}\n\n/** The placeholder syntax an endpoint template uses — the same braces the operation path templates use. */\nexport const PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN = /\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g;\n\n/**\n * Classify every placeholder in an OAuth2 endpoint template by the URL component it forms.\n *\n * ONE function, shared by the transposer (which decides which placeholders need an allowance) and\n * the runtime (which refuses an unallowed one), so the two cannot disagree about what a host is.\n *\n * Deliberately a string scan, not a URL parse: a template whose host is still `{cloud}` is not a\n * parseable URL, which is exactly the population this classifies.\n *\n * - offset 0 → {@link ProviderOAuth2EndpointPlaceholderPosition.ORIGIN};\n * - between the first `://` and the next `/`, `?` or `#` → HOST;\n * - otherwise → PATH_OR_QUERY.\n *\n * This classification is only meaningful for a template with no\n * {@link findProviderOAuth2EndpointTemplateDefects}: a template that does not begin `http(s)://` or a\n * placeholder has no authority this scan can find, and every consumer must refuse it FIRST rather than\n * trust the PATH_OR_QUERY answer it would get here.\n */\nexport function classifyProviderOAuth2EndpointPlaceholders(template: string): readonly ProviderOAuth2EndpointPlaceholderOccurrence[] {\n  const schemeSeparator = template.indexOf('://');\n  let authorityEnd = -1;\n  if (schemeSeparator >= 0) {\n    const rest = template.slice(schemeSeparator + 3);\n    const end = rest.search(/[/?#]/);\n    authorityEnd = end < 0 ? template.length : schemeSeparator + 3 + end;\n  }\n  const occurrences: ProviderOAuth2EndpointPlaceholderOccurrence[] = [];\n  for (const match of template.matchAll(PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN)) {\n    const index = match.index ?? 0;\n    const position = index === 0\n      ? ProviderOAuth2EndpointPlaceholderPosition.ORIGIN\n      : schemeSeparator >= 0 && index > schemeSeparator && index < authorityEnd\n        ? ProviderOAuth2EndpointPlaceholderPosition.HOST\n        : ProviderOAuth2EndpointPlaceholderPosition.PATH_OR_QUERY;\n    const occupiesWholeHost = position === ProviderOAuth2EndpointPlaceholderPosition.HOST\n      && index === schemeSeparator + 3\n      && index + match[0].length === authorityEnd;\n    const followingLiteral = position === ProviderOAuth2EndpointPlaceholderPosition.HOST && !occupiesWholeHost && index === schemeSeparator + 3\n      ? template.slice(index + match[0].length, authorityEnd)\n      : undefined;\n    // Only a PURELY literal remainder qualifies: a second placeholder in the authority is refused as malformed anyway.\n    const literalHostSuffix = followingLiteral !== undefined && followingLiteral.startsWith('.') && !followingLiteral.includes('{') ? followingLiteral : undefined;\n    occurrences.push({ name: match[1]!, position, index, token: match[0], occupiesWholeHost, ...(literalHostSuffix === undefined ? {} : { literalHostSuffix }) });\n  }\n  return occurrences;\n}\n\n\n/**\n * Vendors whose credential is COMPUTED per request rather than sent as a fixed header.\n *\n * A static header covers bearer tokens and API keys, which is most of the world. It cannot express a\n * signature: AWS Signature Version 4 signs the method, the canonical path, the sorted query, a\n * subset of headers, a SHA-256 of the payload and a timestamp, with a key derived from the secret,\n * the date, the region and the service — so the header's VALUE differs for every request and none of\n * its inputs exist when a provider module is authored.\n *\n * Until this existed, such a vendor could not be expressed at all — not badly, not partially. There\n * was no `if` to write, because the field where the answer goes did not exist. 45 transposed actions\n * across `amazon-s3`, `amazon-ses`, `amazon-textract`, `amazon-secrets-manager`, `amazon-sqs`,\n * `amazon-bedrock`, `azure-blob-storage`, `azure-communication-services` and `azure-openai` are\n * blocked on it (#373).\n */\nexport enum ProviderRestSigningScheme {\n  /**\n   * AWS Signature Version 4 — the `Authorization: AWS4-HMAC-SHA256 …` scheme used by every current\n   * AWS service API.\n   * spec-cite: AWS General Reference, \"Signature Version 4 signing process\"\n   * (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv4-signing-process.html)\n   */\n  AWS_SIGV4 = 'AWS_SIGV4',\n  /**\n   * Azure Storage shared-key — `Authorization: SharedKey <account>:<signature>` over a canonicalized\n   * request and resource.\n   * spec-cite: Azure Storage REST, \"Authorize with Shared Key\"\n   * (https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key)\n   */\n  AZURE_SHARED_KEY = 'AZURE_SHARED_KEY',\n}\n\n/**\n * How a provider signs each request.\n *\n * Declared by the provider module and executed by the engine, with NO vendor branch in the executor:\n * the scheme is data, and the signer dispatches on it exhaustively. That is the same discipline the\n * rest of the provider contract keeps — a consumer branches on a contract field, never on a\n * provider ref.\n *\n * The credential is TWO values for both schemes (an identity and a secret), and optionally a third\n * for temporary credentials, which is why it cannot ride in the single `apiKey.secretRef` slot.\n */\nexport interface ProviderRestRequestSigning {\n  readonly scheme: ProviderRestSigningScheme;\n  /** Env-var naming the identity half — an AWS access-key id, an Azure storage account name. */\n  readonly keyIdSecretRef: string;\n  /** Env-var naming the secret half. */\n  readonly secretKeySecretRef: string;\n  /**\n   * Env-var naming a session token, for temporary credentials (STS, a role assumption). Absent means\n   * long-lived credentials; present-but-unset is treated as long-lived rather than as an error,\n   * because the same provider serves both.\n   */\n  readonly sessionTokenSecretRef?: string;\n  /**\n   * AWS_SIGV4: the region and service that scope the derived key. Both are part of the SIGNATURE,\n   * not merely of the URL, so a wrong value fails authentication rather than routing — which is why\n   * they are declared rather than parsed out of the host.\n   */\n  readonly region?: string;\n  readonly service?: string;\n  /**\n   * Env-var overriding {@link region} per deployment, for an application that runs in more than one.\n   * The declared value is the default.\n   */\n  readonly regionEnvVarName?: string;\n}\n\n/**\n * The one function a generated typed client needs, as a TYPE.\n *\n * A generated provider package must not import the engine's runtime to be callable: that would put\n * the whole backend into the module graph of anything that touches a vendor, which is precisely the\n * weight #378 removed (models 20.8 MB against the backend barrel's 160.7 MB). So a client is a\n * FACTORY that takes the executor as an argument — the application wires its own, the package\n * declares only this signature, and nothing crosses at runtime.\n *\n * R3's ergonomics bought with a type rather than a dependency.\n *\n * ## The connection is a parameter, and OPTIONAL for a reason that is not convenience\n *\n * Omitted means the application's own account, acting as itself — the floor, and the only connection\n * that needs no store and no authorization. That default is what keeps the ordinary single-account\n * call as short as it should be.\n *\n * It could not be anything BUT a parameter. One execution may legitimately spend several tenants'\n * accounts — a user action pushing a message to every organization that user belongs to — so a client\n * that read the owner from ambient state could not vary it per call, and the fan-out would be\n * inexpressible through the generated surface even though the engine beneath it supports one.\n */\nexport type ProviderOperationExecute = (\n  providerRef: string,\n  operationId: string,\n  input: Readonly<Record<string, unknown>>,\n  connection?: ExternalProvider_ConnectionTarget,\n) => Promise<unknown>;\n"]}

package/dist/esm/protocols/sms.external-connectors-models.schemas.d.ts

@@ -1,5 +1,3 @@
-import { z } from "zod";
-import { ExternalProvider_ExchangeProtocol_Configuration_Base, ExternalProvider_ExchangeProtocol_Kind, ExternalProvider_ExchangeProtocol_Profile_Base } from "../core/commons.external-connectors-models.schemas";
 /**
  * SMS provider capabilities — what features the provider supports.
  */
@@ -15,41 +13,4 @@ export declare enum SMSProvider_OperationKey {
     SEND_SMS = "sms.send",
     GET_MESSAGE_STATUS = "sms.message.getStatus"
 }
-export type SMSProvider_Profile = ExternalProvider_ExchangeProtocol_Profile_Base & {
-    /** Human-readable provider name */
-    displayName?: string;
-    /** Base URL for REST API */
-    baseURL: string;
-    /** API version */
-    apiVersion?: string;
-    /** Provider capabilities (fixed) */
-    capabilities: SMSProvider_Capability[];
-    /** Provider-imposed limits (fixed) */
-    limits: {
-        maxMessageLength?: number;
-        rateLimit?: {
-            requests: number;
-            period: "second" | "minute" | "hour" | "day";
-        };
-    };
-};
-export type SMSProvider_Configuration = ExternalProvider_ExchangeProtocol_Configuration_Base & {
-    /** Default sender phone number or short code */
-    defaultFromNumber?: string;
-    /** Webhook for delivery events */
-    webhookConfig?: {
-        url: string;
-        secretRef?: string;
-    };
-};
-export declare const SMSProvider_StatusSchema: z.ZodObject<{
-    status: z.ZodEnum<typeof import("..").ExternalProvider_Status>;
-    lastCheckedAt: z.ZodString;
-    errorReason: z.ZodOptional<z.ZodString>;
-    protocolKind: z.ZodLiteral<ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER>;
-    apiConnected: z.ZodOptional<z.ZodBoolean>;
-    rateLimitRemaining: z.ZodOptional<z.ZodNumber>;
-    rateLimitResetAt: z.ZodOptional<z.ZodISODateTime>;
-}, z.core.$strip>;
-export type SMSProvider_Status = z.infer<typeof SMSProvider_StatusSchema>;
 //# sourceMappingURL=sms.external-connectors-models.schemas.d.ts.map

package/dist/esm/protocols/sms.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sms.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/protocols/sms.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,oDAAoD,EACpD,sCAAsC,EACtC,8CAA8C,EAE/C,MAAM,oDAAoD,CAAC;AAmB5D;;GAEG;AACH,oBAAY,sBAAsB;IAChC,YAAY,iBAAiB;IAC7B,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;CACxC;AAED;;GAEG;AACH,oBAAY,wBAAwB;IAClC,QAAQ,aAAa;IACrB,kBAAkB,0BAA0B;CAC7C;AAMD,MAAM,MAAM,mBAAmB,GAAG,8CAA8C,GAAG;IACjF,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAEhB,kBAAkB;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,oCAAoC;IACpC,YAAY,EAAE,sBAAsB,EAAE,CAAC;IAEvC,sCAAsC;IACtC,MAAM,EAAE;QACN,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE;YACV,QAAQ,EAAE,MAAM,CAAC;YACjB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;SAC9C,CAAC;KACH,CAAC;CACH,CAAC;AAMF,MAAM,MAAM,yBAAyB,GAAG,oDAAoD,GAAG;IAC7F,gDAAgD;IAChD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,kCAAkC;IAClC,aAAa,CAAC,EAAE;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH,CAAC;AAMF,eAAO,MAAM,wBAAwB;;;;;;;;iBASnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"sms.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/protocols/sms.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAsBA;;GAEG;AACH,oBAAY,sBAAsB;IAChC,YAAY,iBAAiB;IAC7B,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;CACxC;AAED;;GAEG;AACH,oBAAY,wBAAwB;IAClC,QAAQ,aAAa;IACrB,kBAAkB,0BAA0B;CAC7C"}

package/dist/esm/protocols/sms.external-connectors-models.schemas.js

@@ -1,5 +1,3 @@
-import { z } from "zod";
-import { ExternalProvider_ExchangeProtocol_Kind, ExternalProvider_ExchangeProtocol_Status_BaseSchema, } from "../core/commons.external-connectors-models.schemas.js";
 // ===============================================================
 // SMS Provider
 // --------
@@ -32,15 +30,4 @@ export var SMSProvider_OperationKey;
     SMSProvider_OperationKey["SEND_SMS"] = "sms.send";
     SMSProvider_OperationKey["GET_MESSAGE_STATUS"] = "sms.message.getStatus";
 })(SMSProvider_OperationKey || (SMSProvider_OperationKey = {}));
-// ===============================================================
-// SMS Provider Status Schema
-// ===============================================================
-export const SMSProvider_StatusSchema = ExternalProvider_ExchangeProtocol_Status_BaseSchema.extend({
-    protocolKind: z.literal(ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER),
-    /** API connectivity */
-    apiConnected: z.boolean().optional(),
-    /** Rate limit state */
-    rateLimitRemaining: z.number().optional(),
-    rateLimitResetAt: z.iso.datetime().optional(),
-});
 //# sourceMappingURL=sms.external-connectors-models.schemas.js.map

package/dist/esm/protocols/sms.external-connectors-models.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sms.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/sms.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,sCAAsC,EAEtC,mDAAmD,GACpD,MAAM,oDAAoD,CAAC;AAE5D,kEAAkE;AAClE,eAAe;AACf,WAAW;AACX,mEAAmE;AACnE,+DAA+D;AAC/D,EAAE;AACF,wBAAwB;AACxB,wEAAwE;AACxE,mDAAmD;AACnD,gEAAgE;AAChE,2DAA2D;AAC3D,kEAAkE;AAElE,kEAAkE;AAClE,qBAAqB;AACrB,kEAAkE;AAElE;;GAEG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,uDAA6B,CAAA;IAC7B,+EAAqD,CAAA;IACrD,iEAAuC,CAAA;AACzC,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,iDAAqB,CAAA;IACrB,wEAA4C,CAAA;AAC9C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AA4CD,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE,MAAM,CAAC,MAAM,wBAAwB,GAAG,mDAAmD,CAAC,MAAM,CAAC;IACjG,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,YAAY,CAAC;IAE5E,uBAAuB;IACvB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,uBAAuB;IACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport {\n  ExternalProvider_ExchangeProtocol_Configuration_Base,\n  ExternalProvider_ExchangeProtocol_Kind,\n  ExternalProvider_ExchangeProtocol_Profile_Base,\n  ExternalProvider_ExchangeProtocol_Status_BaseSchema,\n} from \"../core/commons.external-connectors-models.schemas\";\n\n// ===============================================================\n// SMS Provider\n// --------\n// Integration with SMS service providers for sending transactional\n// SMS messages (OTP codes, phone verification, notifications).\n//\n// CONFIGURATION LEVELS:\n// - Profile (Provider-level): Fixed by the provider, cannot be changed.\n//   Examples: API endpoints, capabilities, limits.\n// - Configuration (Consumer-level): User-configurable settings.\n//   Examples: API keys, sender phone number, webhook URLs.\n// ===============================================================\n\n// ===============================================================\n// SMS Provider Enums\n// ===============================================================\n\n/**\n * SMS provider capabilities — what features the provider supports.\n */\nexport enum SMSProvider_Capability {\n  SUPPORTS_OTP = \"supports_otp\",\n  SUPPORTS_DELIVERY_STATUS = \"supports_delivery_status\",\n  SUPPORTS_WEBHOOKS = \"supports_webhooks\",\n}\n\n/**\n * Standard SMS provider operation keys.\n */\nexport enum SMSProvider_OperationKey {\n  SEND_SMS = \"sms.send\",\n  GET_MESSAGE_STATUS = \"sms.message.getStatus\",\n}\n\n// ===============================================================\n// SMS Provider Profile (Provider-level - FIXED by provider)\n// ===============================================================\n\nexport type SMSProvider_Profile = ExternalProvider_ExchangeProtocol_Profile_Base & {\n  /** Human-readable provider name */\n  displayName?: string;\n\n  /** Base URL for REST API */\n  baseURL: string;\n\n  /** API version */\n  apiVersion?: string;\n\n  /** Provider capabilities (fixed) */\n  capabilities: SMSProvider_Capability[];\n\n  /** Provider-imposed limits (fixed) */\n  limits: {\n    maxMessageLength?: number;\n    rateLimit?: {\n      requests: number;\n      period: \"second\" | \"minute\" | \"hour\" | \"day\";\n    };\n  };\n};\n\n// ===============================================================\n// SMS Provider Configuration (Consumer-level - user configurable)\n// ===============================================================\n\nexport type SMSProvider_Configuration = ExternalProvider_ExchangeProtocol_Configuration_Base & {\n  /** Default sender phone number or short code */\n  defaultFromNumber?: string;\n\n  /** Webhook for delivery events */\n  webhookConfig?: {\n    url: string;\n    secretRef?: string;\n  };\n};\n\n// ===============================================================\n// SMS Provider Status Schema\n// ===============================================================\n\nexport const SMSProvider_StatusSchema = ExternalProvider_ExchangeProtocol_Status_BaseSchema.extend({\n  protocolKind: z.literal(ExternalProvider_ExchangeProtocol_Kind.SMS_PROVIDER),\n\n  /** API connectivity */\n  apiConnected: z.boolean().optional(),\n\n  /** Rate limit state */\n  rateLimitRemaining: z.number().optional(),\n  rateLimitResetAt: z.iso.datetime().optional(),\n});\nexport type SMSProvider_Status = z.infer<typeof SMSProvider_StatusSchema>;\n"]}
+{"version":3,"file":"sms.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/sms.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAKA,kEAAkE;AAClE,eAAe;AACf,WAAW;AACX,mEAAmE;AACnE,+DAA+D;AAC/D,EAAE;AACF,wBAAwB;AACxB,wEAAwE;AACxE,mDAAmD;AACnD,gEAAgE;AAChE,2DAA2D;AAC3D,kEAAkE;AAElE,kEAAkE;AAClE,qBAAqB;AACrB,kEAAkE;AAElE;;GAEG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,uDAA6B,CAAA;IAC7B,+EAAqD,CAAA;IACrD,iEAAuC,CAAA;AACzC,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,iDAAqB,CAAA;IACrB,wEAA4C,CAAA;AAC9C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC","sourcesContent":["import { z } from \"zod\";\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  } from \"../core/commons.external-connectors-models.schemas\";\n\n// ===============================================================\n// SMS Provider\n// --------\n// Integration with SMS service providers for sending transactional\n// SMS messages (OTP codes, phone verification, notifications).\n//\n// CONFIGURATION LEVELS:\n// - Profile (Provider-level): Fixed by the provider, cannot be changed.\n//   Examples: API endpoints, capabilities, limits.\n// - Configuration (Consumer-level): User-configurable settings.\n//   Examples: API keys, sender phone number, webhook URLs.\n// ===============================================================\n\n// ===============================================================\n// SMS Provider Enums\n// ===============================================================\n\n/**\n * SMS provider capabilities — what features the provider supports.\n */\nexport enum SMSProvider_Capability {\n  SUPPORTS_OTP = \"supports_otp\",\n  SUPPORTS_DELIVERY_STATUS = \"supports_delivery_status\",\n  SUPPORTS_WEBHOOKS = \"supports_webhooks\",\n}\n\n/**\n * Standard SMS provider operation keys.\n */\nexport enum SMSProvider_OperationKey {\n  SEND_SMS = \"sms.send\",\n  GET_MESSAGE_STATUS = \"sms.message.getStatus\",\n}\n\n"]}

package/dist/esm/protocols/sms.standard-interface.schemas.d.ts

@@ -81,11 +81,11 @@ export declare const StandardSMS_ErrorSchema: z.ZodObject<{
     code: z.ZodEnum<{
         VALIDATION_ERROR: "VALIDATION_ERROR";
         PROVIDER_ERROR: "PROVIDER_ERROR";
-        INVALID_PHONE_NUMBER: "INVALID_PHONE_NUMBER";
         RATE_LIMIT_EXCEEDED: "RATE_LIMIT_EXCEEDED";
         AUTHENTICATION_FAILED: "AUTHENTICATION_FAILED";
         QUOTA_EXCEEDED: "QUOTA_EXCEEDED";
         UNKNOWN_ERROR: "UNKNOWN_ERROR";
+        INVALID_PHONE_NUMBER: "INVALID_PHONE_NUMBER";
     }>;
     message: z.ZodString;
     provider: z.ZodOptional<z.ZodString>;

package/dist/esm/protocols/sms.standard-interface.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sms.standard-interface.schemas.d.ts","sourceRoot":"","sources":["../../../src/protocols/sms.standard-interface.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,0BAA0B;IACpC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,0BAA0B;CAChD;AAMD,eAAO,MAAM,6BAA6B;;;;;iBAYxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF;;;;;;;;;;;;;GAaG;AACH,oBAAY,iBAAiB;IAC3B,6DAA6D;IAC7D,MAAM,WAAW;IACjB,uDAAuD;IACvD,IAAI,SAAS;IACb,8CAA8C;IAC9C,SAAS,cAAc;IACvB,8FAA8F;IAC9F,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,8BAA8B;;;;iBAMzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;iBAalC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"sms.standard-interface.schemas.d.ts","sourceRoot":"","sources":["../../../../src/protocols/sms.standard-interface.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,0BAA0B;IACpC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,0BAA0B;CAChD;AAMD,eAAO,MAAM,6BAA6B;;;;;iBAYxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAMpF;;;;;;;;;;;;;GAaG;AACH,oBAAY,iBAAiB;IAC3B,6DAA6D;IAC7D,MAAM,WAAW;IACjB,uDAAuD;IACvD,IAAI,SAAS;IACb,8CAA8C;IAC9C,SAAS,cAAc;IACvB,8FAA8F;IAC9F,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,8BAA8B;;;;iBAMzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;iBAalC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/esm/protocols/sms.standard-interface.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sms.standard-interface.schemas.js","sourceRoot":"","sources":["../../../src/protocols/sms.standard-interface.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kEAAkE;AAClE,yBAAyB;AACzB,WAAW;AACX,qEAAqE;AACrE,sEAAsE;AACtE,+BAA+B;AAC/B,EAAE;AACF,qBAAqB;AACrB,qDAAqD;AACrD,6EAA6E;AAC7E,yEAAyE;AACzE,kEAAkE;AAElE,kEAAkE;AAClE,gCAAgC;AAChC,kEAAkE;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,0BAgBX;AAhBD,WAAY,0BAA0B;IACpC;;;;;;;;;;;;;OAaG;IACH,6EAA+C,CAAA;AACjD,CAAC,EAhBW,0BAA0B,KAA1B,0BAA0B,QAgBrC;AAED,kEAAkE;AAClE,4BAA4B;AAC5B,kEAAkE;AAElE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,6CAA6C;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;IAErG,qFAAqF;IACrF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE3B,uBAAuB;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAEjC,wCAAwC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,iBASX;AATD,WAAY,iBAAiB;IAC3B,6DAA6D;IAC7D,sCAAiB,CAAA;IACjB,uDAAuD;IACvD,kCAAa,CAAA;IACb,8CAA8C;IAC9C,4CAAuB,CAAA;IACvB,8FAA8F;IAC9F,sCAAiB,CAAA;AACnB,CAAC,EATW,iBAAiB,KAAjB,iBAAiB,QAS5B;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,mCAAmC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,+CAA+C;IAC/C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,kEAAkE;AAClE,qBAAqB;AACrB,kEAAkE;AAElE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,kBAAkB;QAClB,gBAAgB;QAChB,sBAAsB;QACtB,qBAAqB;QACrB,uBAAuB;QACvB,gBAAgB;QAChB,eAAe;KAChB,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n// ===============================================================\n// Standard SMS Interface\n// --------\n// This is the canonical interface that Wildo uses internally to send\n// SMS messages. The ETL layer transforms these standard requests into\n// provider-specific API calls.\n//\n// Design Principles:\n// 1. Provider-agnostic - works with any SMS provider\n// 2. Minimal surface area - focused on transactional SMS (OTP, verification)\n// 3. Extensible - new fields can be added without breaking existing code\n// ===============================================================\n\n// ===============================================================\n// SMS Provider Credential Shape\n// ===============================================================\n\n/**\n * How a `kind: SMS` provider's credential bundle is SHAPED, and therefore how the engine parses\n * the resolved secret and authenticates the send request.\n *\n * The engine owns this — not the provider — because parsing a bundle means touching the secret,\n * and a provider module's request builder is a pure function that must never see one. So the\n * contract DECLARES which shape it uses and the engine implements it, exactly as the email arm\n * declares `apiKey.scheme` and lets the engine compose the header.\n *\n * ## Why a single member, and why that is the point\n *\n * One shape has a declarer today. A member is added here only together with its parse-and-\n * authenticate branch in the SMS transport, and that branch is an exhaustive `switch` with a\n * `never` check — so a member added without an implementation fails COMPILATION rather than\n * shipping a provider the engine cannot authenticate. Equally, a second SMS provider whose\n * credential is shaped differently cannot name a member that does not exist: it is refused at\n * declaration time, which is the strongest available form of \"never silently handed Twilio's\".\n *\n * An `'api-key'` member stood here until 2026-09-09 and was pure declaration: no production\n * provider named it, no consumer read it, and no code implemented it — its only use anywhere was\n * one test fixture about an unrelated projection. It was removed rather than implemented, because\n * inventing a header shape for a provider that does not exist is inventing a contract nobody can\n * check.\n */\nexport enum SmsProviderCredentialShape {\n  /**\n   * A two-part bundle: a non-secret account IDENTIFIER and the secret that authenticates it.\n   * The engine authenticates with HTTP Basic — `base64(accountId:secret)` — and makes the\n   * account identifier available for substitution into the contract's `sendEndpointPath`.\n   *\n   * Basic credentials are carried in the `Authorization` header by definition, so the header name\n   * is not a per-provider choice and is deliberately not declared.\n   * spec-cite: RFC 7617 §2 (The 'Basic' HTTP Authentication Scheme) — the credentials are the\n   * base64 of `user-id \":\" password`, transmitted in the `Authorization` header.\n   *\n   * Twilio's `AccountSid` + `AuthToken` is this shape. The name is deliberately NOT Twilio's:\n   * the value was `'account-sid-auth-token'` until 2026-09-09, which put one vendor's vocabulary\n   * on a contract every SMS provider has to speak.\n   */\n  ACCOUNT_ID_AND_SECRET = \"account-id-and-secret\",\n}\n\n// ===============================================================\n// Standard SMS Send Request\n// ===============================================================\n\nexport const StandardSMS_SendRequestSchema = z.object({\n  /** Recipient phone number in E.164 format */\n  to: z.string().regex(/^\\+?[1-9]\\d{1,14}$/, { error: \"Invalid phone number (E.164 format required)\" }),\n\n  /** Sender phone number or short code (optional, uses provider default if not set) */\n  from: z.string().optional(),\n\n  /** SMS message body */\n  body: z.string().min(1).max(1600),\n\n  /** Metadata for correlation/tracking */\n  metadata: z.record(z.string(), z.string()).optional(),\n});\nexport type StandardSMS_SendRequest = z.infer<typeof StandardSMS_SendRequestSchema>;\n\n// ===============================================================\n// Standard SMS Send Response\n// ===============================================================\n\n/**\n * The delivery states this framework recognises, and the vocabulary a provider's\n * `parseSendResponse` projects its vendor's own states onto.\n *\n * Named rather than left inline because a vendor's vocabulary is LARGER than this one and the\n * mapping between them is the interesting part. Twilio alone reports `accepted`, `scheduled`,\n * `sending`, `undelivered` and `canceled`, none of which is a member here — so the per-member\n * question \"which vendor states land on this one, and why\" needs somewhere to be answered, and an\n * inline `z.enum` has nowhere to put it.\n *\n * The four members are unchanged; this only gives them a home. `.optional()` on the field is what\n * says a provider may report NO state, which is the honest answer for a vendor state this\n * vocabulary does not cover — better than forcing a wrong one.\n */\nexport enum SmsDeliveryStatus {\n  /** Accepted by the provider, not yet handed to a carrier. */\n  QUEUED = \"queued\",\n  /** Handed to a carrier; delivery not yet confirmed. */\n  SENT = \"sent\",\n  /** The carrier confirmed handset delivery. */\n  DELIVERED = \"delivered\",\n  /** Terminal failure, whether the provider rejected it or the carrier could not deliver it. */\n  FAILED = \"failed\",\n}\n\nexport const StandardSMS_SendResponseSchema = z.object({\n  success: z.boolean(),\n  /** Provider-assigned message ID */\n  messageId: z.string(),\n  /** Delivery status if available immediately */\n  status: z.enum(SmsDeliveryStatus).optional(),\n});\nexport type StandardSMS_SendResponse = z.infer<typeof StandardSMS_SendResponseSchema>;\n\n// ===============================================================\n// Standard SMS Error\n// ===============================================================\n\nexport const StandardSMS_ErrorSchema = z.object({\n  code: z.enum([\n    \"VALIDATION_ERROR\",\n    \"PROVIDER_ERROR\",\n    \"INVALID_PHONE_NUMBER\",\n    \"RATE_LIMIT_EXCEEDED\",\n    \"AUTHENTICATION_FAILED\",\n    \"QUOTA_EXCEEDED\",\n    \"UNKNOWN_ERROR\",\n  ]),\n  message: z.string(),\n  provider: z.string().optional(),\n  details: z.unknown().optional(),\n});\nexport type StandardSMS_Error = z.infer<typeof StandardSMS_ErrorSchema>;\n"]}
+{"version":3,"file":"sms.standard-interface.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/sms.standard-interface.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kEAAkE;AAClE,yBAAyB;AACzB,WAAW;AACX,qEAAqE;AACrE,sEAAsE;AACtE,+BAA+B;AAC/B,EAAE;AACF,qBAAqB;AACrB,qDAAqD;AACrD,6EAA6E;AAC7E,yEAAyE;AACzE,kEAAkE;AAElE,kEAAkE;AAClE,gCAAgC;AAChC,kEAAkE;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,0BAgBX;AAhBD,WAAY,0BAA0B;IACpC;;;;;;;;;;;;;OAaG;IACH,6EAA+C,CAAA;AACjD,CAAC,EAhBW,0BAA0B,KAA1B,0BAA0B,QAgBrC;AAED,kEAAkE;AAClE,4BAA4B;AAC5B,kEAAkE;AAElE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,6CAA6C;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;IAErG,qFAAqF;IACrF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE3B,uBAAuB;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAEjC,wCAAwC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,iBASX;AATD,WAAY,iBAAiB;IAC3B,6DAA6D;IAC7D,sCAAiB,CAAA;IACjB,uDAAuD;IACvD,kCAAa,CAAA;IACb,8CAA8C;IAC9C,4CAAuB,CAAA;IACvB,8FAA8F;IAC9F,sCAAiB,CAAA;AACnB,CAAC,EATW,iBAAiB,KAAjB,iBAAiB,QAS5B;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,mCAAmC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,+CAA+C;IAC/C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,kEAAkE;AAClE,qBAAqB;AACrB,kEAAkE;AAElE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,kBAAkB;QAClB,gBAAgB;QAChB,sBAAsB;QACtB,qBAAqB;QACrB,uBAAuB;QACvB,gBAAgB;QAChB,eAAe;KAChB,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n// ===============================================================\n// Standard SMS Interface\n// --------\n// This is the canonical interface that Wildo uses internally to send\n// SMS messages. The ETL layer transforms these standard requests into\n// provider-specific API calls.\n//\n// Design Principles:\n// 1. Provider-agnostic - works with any SMS provider\n// 2. Minimal surface area - focused on transactional SMS (OTP, verification)\n// 3. Extensible - new fields can be added without breaking existing code\n// ===============================================================\n\n// ===============================================================\n// SMS Provider Credential Shape\n// ===============================================================\n\n/**\n * How a `kind: SMS` provider's credential bundle is SHAPED, and therefore how the engine parses\n * the resolved secret and authenticates the send request.\n *\n * The engine owns this — not the provider — because parsing a bundle means touching the secret,\n * and a provider module's request builder is a pure function that must never see one. So the\n * contract DECLARES which shape it uses and the engine implements it, exactly as the email arm\n * declares `apiKey.scheme` and lets the engine compose the header.\n *\n * ## Why a single member, and why that is the point\n *\n * One shape has a declarer today. A member is added here only together with its parse-and-\n * authenticate branch in the SMS transport, and that branch is an exhaustive `switch` with a\n * `never` check — so a member added without an implementation fails COMPILATION rather than\n * shipping a provider the engine cannot authenticate. Equally, a second SMS provider whose\n * credential is shaped differently cannot name a member that does not exist: it is refused at\n * declaration time, which is the strongest available form of \"never silently handed Twilio's\".\n *\n * An `'api-key'` member stood here until 2026-09-09 and was pure declaration: no production\n * provider named it, no consumer read it, and no code implemented it — its only use anywhere was\n * one test fixture about an unrelated projection. It was removed rather than implemented, because\n * inventing a header shape for a provider that does not exist is inventing a contract nobody can\n * check.\n */\nexport enum SmsProviderCredentialShape {\n  /**\n   * A two-part bundle: a non-secret account IDENTIFIER and the secret that authenticates it.\n   * The engine authenticates with HTTP Basic — `base64(accountId:secret)` — and makes the\n   * account identifier available for substitution into the contract's `sendEndpointPath`.\n   *\n   * Basic credentials are carried in the `Authorization` header by definition, so the header name\n   * is not a per-provider choice and is deliberately not declared.\n   * spec-cite: RFC 7617 §2 (The 'Basic' HTTP Authentication Scheme) — the credentials are the\n   * base64 of `user-id \":\" password`, transmitted in the `Authorization` header.\n   *\n   * Twilio's `AccountSid` + `AuthToken` is this shape. The name is deliberately NOT Twilio's:\n   * the value was `'account-sid-auth-token'` until 2026-09-09, which put one vendor's vocabulary\n   * on a contract every SMS provider has to speak.\n   */\n  ACCOUNT_ID_AND_SECRET = \"account-id-and-secret\",\n}\n\n// ===============================================================\n// Standard SMS Send Request\n// ===============================================================\n\nexport const StandardSMS_SendRequestSchema = z.object({\n  /** Recipient phone number in E.164 format */\n  to: z.string().regex(/^\\+?[1-9]\\d{1,14}$/, { error: \"Invalid phone number (E.164 format required)\" }),\n\n  /** Sender phone number or short code (optional, uses provider default if not set) */\n  from: z.string().optional(),\n\n  /** SMS message body */\n  body: z.string().min(1).max(1600),\n\n  /** Metadata for correlation/tracking */\n  metadata: z.record(z.string(), z.string()).optional(),\n});\nexport type StandardSMS_SendRequest = z.infer<typeof StandardSMS_SendRequestSchema>;\n\n// ===============================================================\n// Standard SMS Send Response\n// ===============================================================\n\n/**\n * The delivery states this framework recognises, and the vocabulary a provider's\n * `parseSendResponse` projects its vendor's own states onto.\n *\n * Named rather than left inline because a vendor's vocabulary is LARGER than this one and the\n * mapping between them is the interesting part. Twilio alone reports `accepted`, `scheduled`,\n * `sending`, `undelivered` and `canceled`, none of which is a member here — so the per-member\n * question \"which vendor states land on this one, and why\" needs somewhere to be answered, and an\n * inline `z.enum` has nowhere to put it.\n *\n * The four members are unchanged; this only gives them a home. `.optional()` on the field is what\n * says a provider may report NO state, which is the honest answer for a vendor state this\n * vocabulary does not cover — better than forcing a wrong one.\n */\nexport enum SmsDeliveryStatus {\n  /** Accepted by the provider, not yet handed to a carrier. */\n  QUEUED = \"queued\",\n  /** Handed to a carrier; delivery not yet confirmed. */\n  SENT = \"sent\",\n  /** The carrier confirmed handset delivery. */\n  DELIVERED = \"delivered\",\n  /** Terminal failure, whether the provider rejected it or the carrier could not deliver it. */\n  FAILED = \"failed\",\n}\n\nexport const StandardSMS_SendResponseSchema = z.object({\n  success: z.boolean(),\n  /** Provider-assigned message ID */\n  messageId: z.string(),\n  /** Delivery status if available immediately */\n  status: z.enum(SmsDeliveryStatus).optional(),\n});\nexport type StandardSMS_SendResponse = z.infer<typeof StandardSMS_SendResponseSchema>;\n\n// ===============================================================\n// Standard SMS Error\n// ===============================================================\n\nexport const StandardSMS_ErrorSchema = z.object({\n  code: z.enum([\n    \"VALIDATION_ERROR\",\n    \"PROVIDER_ERROR\",\n    \"INVALID_PHONE_NUMBER\",\n    \"RATE_LIMIT_EXCEEDED\",\n    \"AUTHENTICATION_FAILED\",\n    \"QUOTA_EXCEEDED\",\n    \"UNKNOWN_ERROR\",\n  ]),\n  message: z.string(),\n  provider: z.string().optional(),\n  details: z.unknown().optional(),\n});\nexport type StandardSMS_Error = z.infer<typeof StandardSMS_ErrorSchema>;\n"]}