@wildo-ai/external-connectors-models 1.1.5 → 1.1.6

package/dist/esm/protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models.js

@@ -0,0 +1,66 @@
+import { classifyProviderOAuth2EndpointPlaceholders, findProviderOAuth2EndpointTemplateDefects, ProviderOAuth2EndpointHostAllowanceKind, ProviderOAuth2EndpointPlaceholderPosition, } from './rest-operations.external-connectors-models.schemas.js';
+/** See {@link ProviderOAuth2TokenEndpointHosts}. Pure; never throws. */
+export function describeProviderOAuth2TokenEndpointHosts(oauth2) {
+    const undeterminable = { exact: [], suffixes: [], undeterminable: true };
+    const template = oauth2.tokenUrl;
+    if (typeof template !== 'string' || findProviderOAuth2EndpointTemplateDefects(template).length > 0)
+        return undeterminable;
+    const hostForming = classifyProviderOAuth2EndpointPlaceholders(template)
+        .filter((occurrence) => occurrence.position !== ProviderOAuth2EndpointPlaceholderPosition.PATH_OR_QUERY);
+    if (hostForming.length === 0) {
+        // Path placeholders are still braces here; the host is literal, which is all this reads.
+        const host = literalHostOf(template);
+        return host === undefined ? undeterminable : { exact: [host], suffixes: [], undeterminable: false };
+    }
+    if (hostForming.length > 1)
+        return undeterminable;
+    const [occurrence] = hostForming;
+    const allowance = oauth2.endpointHostAllowances?.[occurrence.name];
+    if (allowance === undefined || allowance.kind !== ProviderOAuth2EndpointHostAllowanceKind.DECLARED_VALUES)
+        return undeterminable;
+    if (occurrence.position === ProviderOAuth2EndpointPlaceholderPosition.ORIGIN) {
+        const exact = [];
+        for (const value of allowance.values) {
+            const host = literalHostOf(value);
+            if (host === undefined)
+                return undeterminable;
+            exact.push(host);
+        }
+        return { exact, suffixes: [...(allowance.hostSuffixes ?? [])].map((suffix) => suffix.toLowerCase()), undeterminable: false };
+    }
+    if (!occurrence.occupiesWholeHost)
+        return undeterminable;
+    return {
+        exact: allowance.values.map((value) => value.toLowerCase()),
+        suffixes: [...(allowance.hostSuffixes ?? [])].map((suffix) => suffix.toLowerCase()),
+        undeterminable: false,
+    };
+}
+/**
+ * The lower-case host of an absolute `http(s)://` string, without port — a string scan rather than a `URL`
+ * parse, because this package carries no DOM or Node library types. Only called on a template
+ * `findProviderOAuth2EndpointTemplateDefects` already admitted (or a declared origin value), so the authority
+ * has no userinfo or backslash to confuse the scan.
+ */
+function literalHostOf(value) {
+    const match = /^https?:\/\/([^/?#]+)/i.exec(value);
+    if (match === null)
+        return undefined;
+    const host = match[1].replace(/:\d+$/, '').toLowerCase();
+    return host.length === 0 || host.includes('{') || host.includes('@') ? undefined : host;
+}
+/**
+ * Whether two token-endpoint host sets can name the same authorization server: `true` when they share a
+ * host (or one's host falls under the other's suffix, or two suffixes nest), `false` when both are known
+ * and disjoint, `undefined` when either side is undeterminable and no overlap was found.
+ */
+export function providerOAuth2TokenEndpointHostsIntersect(left, right) {
+    const underSuffix = (host, suffix) => host.endsWith(suffix) && host.length > suffix.length;
+    const overlaps = left.exact.some((host) => right.exact.includes(host) || right.suffixes.some((suffix) => underSuffix(host, suffix)))
+        || right.exact.some((host) => left.suffixes.some((suffix) => underSuffix(host, suffix)))
+        || left.suffixes.some((suffix) => right.suffixes.some((other) => suffix.endsWith(other) || other.endsWith(suffix)));
+    if (overlaps)
+        return true;
+    return left.undeterminable || right.undeterminable ? undefined : false;
+}
+//# sourceMappingURL=provider-oauth2-token-endpoint-hosts.external-connectors-models.js.map

package/dist/esm/protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-oauth2-token-endpoint-hosts.external-connectors-models.js","sourceRoot":"","sources":["../../../../src/protocols/provider-oauth2-token-endpoint-hosts.external-connectors-models.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0CAA0C,EAC1C,yCAAyC,EACzC,uCAAuC,EACvC,yCAAyC,GAE1C,MAAM,sDAAsD,CAAC;AAgC9D,wEAAwE;AACxE,MAAM,UAAU,wCAAwC,CACtD,MAAuE;IAEvE,MAAM,cAAc,GAAqC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC3G,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,yCAAyC,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC;IAE1H,MAAM,WAAW,GAAG,0CAA0C,CAAC,QAAQ,CAAC;SACrE,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,yCAAyC,CAAC,aAAa,CAAC,CAAC;IAC3G,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,yFAAyF;QACzF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC;IAElD,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC,UAAW,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,uCAAuC,CAAC,eAAe;QAAE,OAAO,cAAc,CAAC;IAEjI,IAAI,UAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,MAAM,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,cAAc,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAC/H,CAAC;IACD,IAAI,CAAC,UAAW,CAAC,iBAAiB;QAAE,OAAO,cAAc,CAAC;IAC1D,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3D,QAAQ,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACnF,cAAc,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yCAAyC,CACvD,IAAsC,EACtC,KAAuC;IAEvC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,MAAc,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACpH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;WAC/H,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;WACrF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACzE,CAAC","sourcesContent":["import {\n  classifyProviderOAuth2EndpointPlaceholders,\n  findProviderOAuth2EndpointTemplateDefects,\n  ProviderOAuth2EndpointHostAllowanceKind,\n  ProviderOAuth2EndpointPlaceholderPosition,\n  type ProviderRestOAuth2,\n} from './rest-operations.external-connectors-models.schemas';\n\n/**\n * The hosts an OAuth2 TOKEN endpoint template can resolve to, derived from the template and its declared\n * host allowances — values-free, so it can travel in a companion contribution and be compared at\n * `wildo config sync` without loading the provider's module (#1725).\n *\n * ## Why the token endpoint, and why hosts\n *\n * A declared shared connection has ONE OAuth client, the base ref's. A member ref whose own catalogue entry\n * names a different AUTHORIZATION SERVER is not the same vendor grant at all — a refresh token Microsoft\n * issued means nothing to another server — so declaring the two into one connection is a mistake that must\n * be refused rather than discovered when the first refresh fails. The token endpoint is where a grant is\n * redeemed and renewed, and its host is what identifies the server that issued it.\n *\n * Sets, not strings, because a catalogue endpoint is often templated (`https://{cloud}/{tenantId}/…`) and\n * admits several login hosts; two refs agree on the authorization server when their sets can meet.\n */\nexport interface ProviderOAuth2TokenEndpointHosts {\n  /** Exact lower-case hosts the token endpoint may resolve to. */\n  readonly exact: readonly string[];\n  /** Dotted host suffixes it may resolve to (`<labels><suffix>`), from a declared allowance. */\n  readonly suffixes: readonly string[];\n  /**\n   * `true` when the set cannot be known from the declaration — a host filled from the deployment\n   * (`DEPLOYMENT_BASE_URL` / `DEPLOYMENT_CONFIGURED`), a partial-host template, a template defect, or a\n   * host placeholder with no allowance. A comparison involving an undeterminable side is answered\n   * `undefined`, never guessed.\n   */\n  readonly undeterminable: boolean;\n}\n\n/** See {@link ProviderOAuth2TokenEndpointHosts}. Pure; never throws. */\nexport function describeProviderOAuth2TokenEndpointHosts(\n  oauth2: Pick<ProviderRestOAuth2, 'tokenUrl' | 'endpointHostAllowances'>,\n): ProviderOAuth2TokenEndpointHosts {\n  const undeterminable: ProviderOAuth2TokenEndpointHosts = { exact: [], suffixes: [], undeterminable: true };\n  const template = oauth2.tokenUrl;\n  if (typeof template !== 'string' || findProviderOAuth2EndpointTemplateDefects(template).length > 0) return undeterminable;\n\n  const hostForming = classifyProviderOAuth2EndpointPlaceholders(template)\n    .filter((occurrence) => occurrence.position !== ProviderOAuth2EndpointPlaceholderPosition.PATH_OR_QUERY);\n  if (hostForming.length === 0) {\n    // Path placeholders are still braces here; the host is literal, which is all this reads.\n    const host = literalHostOf(template);\n    return host === undefined ? undeterminable : { exact: [host], suffixes: [], undeterminable: false };\n  }\n  if (hostForming.length > 1) return undeterminable;\n\n  const [occurrence] = hostForming;\n  const allowance = oauth2.endpointHostAllowances?.[occurrence!.name];\n  if (allowance === undefined || allowance.kind !== ProviderOAuth2EndpointHostAllowanceKind.DECLARED_VALUES) return undeterminable;\n\n  if (occurrence!.position === ProviderOAuth2EndpointPlaceholderPosition.ORIGIN) {\n    const exact: string[] = [];\n    for (const value of allowance.values) {\n      const host = literalHostOf(value);\n      if (host === undefined) return undeterminable;\n      exact.push(host);\n    }\n    return { exact, suffixes: [...(allowance.hostSuffixes ?? [])].map((suffix) => suffix.toLowerCase()), undeterminable: false };\n  }\n  if (!occurrence!.occupiesWholeHost) return undeterminable;\n  return {\n    exact: allowance.values.map((value) => value.toLowerCase()),\n    suffixes: [...(allowance.hostSuffixes ?? [])].map((suffix) => suffix.toLowerCase()),\n    undeterminable: false,\n  };\n}\n\n/**\n * The lower-case host of an absolute `http(s)://` string, without port — a string scan rather than a `URL`\n * parse, because this package carries no DOM or Node library types. Only called on a template\n * `findProviderOAuth2EndpointTemplateDefects` already admitted (or a declared origin value), so the authority\n * has no userinfo or backslash to confuse the scan.\n */\nfunction literalHostOf(value: string): string | undefined {\n  const match = /^https?:\\/\\/([^/?#]+)/i.exec(value);\n  if (match === null) return undefined;\n  const host = match[1]!.replace(/:\\d+$/, '').toLowerCase();\n  return host.length === 0 || host.includes('{') || host.includes('@') ? undefined : host;\n}\n\n/**\n * Whether two token-endpoint host sets can name the same authorization server: `true` when they share a\n * host (or one's host falls under the other's suffix, or two suffixes nest), `false` when both are known\n * and disjoint, `undefined` when either side is undeterminable and no overlap was found.\n */\nexport function providerOAuth2TokenEndpointHostsIntersect(\n  left: ProviderOAuth2TokenEndpointHosts,\n  right: ProviderOAuth2TokenEndpointHosts,\n): boolean | undefined {\n  const underSuffix = (host: string, suffix: string): boolean => host.endsWith(suffix) && host.length > suffix.length;\n  const overlaps = left.exact.some((host) => right.exact.includes(host) || right.suffixes.some((suffix) => underSuffix(host, suffix)))\n    || right.exact.some((host) => left.suffixes.some((suffix) => underSuffix(host, suffix)))\n    || left.suffixes.some((suffix) => right.suffixes.some((other) => suffix.endsWith(other) || other.endsWith(suffix)));\n  if (overlaps) return true;\n  return left.undeterminable || right.undeterminable ? undefined : false;\n}\n"]}

package/dist/esm/protocols/rest-operations.external-connectors-models.schemas.d.ts

@@ -295,6 +295,26 @@ export interface ProviderRestOperationCatalogue {
     readonly domains: readonly string[];
     /** Keyed by `operationId`. */
     readonly operations: Readonly<Record<string, ProviderRestOperation>>;
+    /**
+     * Which package contributed an operation that the provider's OWN module does not declare, keyed by
+     * `operationId` (#1672). Absent on every catalogue a provider module loads itself; set only by the
+     * framework when it merges an opted-in AUGMENTATION into a provider it does not own.
+     *
+     * A catalogue value and not a property of the operation, on purpose: an operation declaration is the
+     * augmentation author's data, and a field the author could write would let a package claim to be
+     * somebody else. The merge refuses a loaded catalogue that already carries this field.
+     *
+     * Read by the operation executor, which writes the contributor into the `PROVIDER_OPERATION_CALL` audit
+     * row: a call spending a shared grant must say whose code declared the request it sent.
+     */
+    readonly augmentedBy?: Readonly<Record<string, ProviderRestOperationContributor>>;
+}
+/** The package that contributed an operation to a provider it does not own (#1672). */
+export interface ProviderRestOperationContributor {
+    /** The augmentation package's npm name, as its own manifest states it. */
+    readonly packageName: string;
+    /** The installed version of that package, as `wildo config sync` read it from the manifest. */
+    readonly packageVersion: string;
 }
 /** @wildo_source:part:end external-connectors.models.rest-operation-contract */
 /**
@@ -329,9 +349,96 @@ export interface ProviderRestCallSemantics {
         /** Linear backoff base — attempt N waits `backoffMs * (N - 1)`. */
         readonly backoffMs: number;
     };
-    /** A local sliding-window ceiling; the call REFUSES when exhausted rather than queueing. */
+    /**
+     * This REF's share of its connection's allowance: a sliding-window ceiling counted for every call made
+     * through this ref, whichever account it spends (#1729).
+     *
+     * It is a CEILING UNDER the connection's own budgets ({@link ProviderRateBudgetDeclaration}, declared by
+     * the connection's base), never a statement of the vendor's limit: several refs of one shared connection
+     * each keep their own ceiling and all draw on the one vendor allowance together.
+     */
     readonly maxRequestsPerMinute?: number;
 }
+/** @wildo_source:part:start external-connectors.models.connection-rate-budgets facet:layer:shared facet:family:provider facet:audience:app-developer */
+/**
+ * WHOSE allowance a vendor counts a request against, under one connection (#1729).
+ *
+ * A connection is one application registration at the vendor (one OAuth client, one API project) — the
+ * base provider's, however many refs spend it. Vendors meter on two axes of it, and a provider declares the
+ * one each of its limits uses:
+ *
+ * | vendor wording | member |
+ * |---|---|
+ * | Microsoft Graph "per app across all tenants"; Google "per minute per project" | {@link CONNECTION} |
+ * | Google "per minute per user per project"; Dataverse "for each user"; Graph "per app per tenant" / "per app and mailbox" when the grant owner IS that tenant or mailbox | {@link OWNER} |
+ *
+ * spec-cite: https://learn.microsoft.com/en-us/graph/throttling-limits — the global-limits table ("Per app across all
+ * tenants") and the scope list "per app across all tenants, per tenant for all apps, per app per tenant"; and
+ * https://developers.google.com/workspace/drive/api/guides/limits — "per minute per project" / "per minute per user per
+ * project". Fetched 2026-09-28.
+ *
+ * Deliberately NOT a member: "per tenant for all apps" (Graph). It counts OTHER applications' calls, which this
+ * deployment cannot see, so no local counter can hold it; the vendor's `429` is the only honest signal there.
+ */
+export declare enum ProviderRateBudgetPartition {
+    /** One allowance for the whole connection — every ref, every account it acts for, every process. */
+    CONNECTION = "connection",
+    /** One allowance per account the connection acts for — the grant's owner (a person, an organization, the deployment). */
+    OWNER = "owner"
+}
+/**
+ * One limit a vendor publishes, as the connection's BASE provider declares it (#1729).
+ *
+ * Read only from the connection's base: a member ref's declaration is inert, exactly like a member's OAuth client,
+ * because the limit belongs to the registration and the base owns the registration. Declared on the REST contract
+ * (`rest.rateBudgets`) for a connection whose tokens serve one resource, and on each OAuth2 AUDIENCE
+ * (`oauth2.audiences.<id>.rateBudgets`) for a connection spanning several — Microsoft Graph and a Dataverse
+ * environment are metered by different services with different numbers, so one list for both would be wrong for one.
+ *
+ * Counted by the engine BEFORE a request leaves: a call waits for room (bounded, see the executor's
+ * `rateBudgetWaitMs`) instead of spending a request the vendor would answer with `429`. The window is SLIDING, which
+ * is at least as strict as a vendor's fixed window of the same length.
+ */
+export interface ProviderRateBudgetDeclaration {
+    /** How many requests the window admits. */
+    readonly maxRequests: number;
+    /** The window's length, in seconds, as the vendor states it (Graph's global limit is per 10 s, Dataverse's per 300 s). */
+    readonly windowSeconds: number;
+    /** Whose allowance it is — see {@link ProviderRateBudgetPartition}. */
+    readonly partition: ProviderRateBudgetPartition;
+}
+/**
+ * Where a budget was COUNTED, as the call that spent it observed (#1729): `shared` when the deployment's shared store
+ * (Redis) counted it for every process of the application — backend replicas, minions, workers — and `process` when
+ * only this process did, because no shared store is configured here or it did not answer. Recorded on the call's audit
+ * row, so a per-process count is visible rather than implied.
+ */
+export declare enum RateBudgetCounting {
+    SHARED = "shared",
+    PROCESS = "process"
+}
+/**
+ * The defects of a connection's rate-budget declarations: a non-positive number, and a contract-level list beside
+ * `oauth2.audiences` — which would apply to nothing, since every call of such a connection is on one audience. A pure
+ * function so the registry refuses it at boot and a test pins it without a host.
+ */
+export declare function describeProviderRateBudgetDefects(input: {
+    readonly contractRateBudgets?: readonly ProviderRateBudgetDeclaration[];
+    readonly audiences?: Readonly<Record<string, {
+        readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[];
+    }>>;
+}): string[];
+/**
+ * The declarations that apply to one call: the audience's own when the call's token is for an audience, else the
+ * contract's. Nothing is inherited between the two — see {@link describeProviderRateBudgetDefects}.
+ */
+export declare function selectProviderRateBudgetDeclarations(input: {
+    readonly contractRateBudgets?: readonly ProviderRateBudgetDeclaration[];
+    readonly audience?: {
+        readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[];
+    };
+}): readonly ProviderRateBudgetDeclaration[];
+/** @wildo_source:part:end external-connectors.models.connection-rate-budgets */
 /**
  * A provider whose credential is MINTED by an authorization-code exchange rather than pasted.
  *
@@ -411,11 +518,33 @@ export interface ProviderRestOAuth2 {
      *   a caller-chosen resource would have the vendor mint a token for a host nobody declared.
      * - `{permissions}` — the placeholder IS the whole scope entry, and its value is one or more scope
      *   tokens chosen from {@link scopeValueAllowances}. Such a value can itself name a resource
-     *   (`https://graph.microsoft.us/.default`), so it is a closed choice, never free text.
+     *   (`https://graph.microsoft.com/.default`), so it is a closed choice, never free text.
      *
      * Any other placement (`api://{x}`, `{a}{b}`, `{x}.default`) is refused as malformed.
      */
     readonly scopes?: readonly string[];
+    /**
+     * How this vendor lets an EXISTING grant grow by one permission (#1671) — declared by the provider module that
+     * owns the OAuth client, never guessed by the engine. See {@link ProviderOAuth2IncrementalConsent}.
+     *
+     * Absent means the vendor's behaviour is not recorded, so a re-authorization for a missing scope RESTATES what the
+     * grant already holds beside the addition: an ordinary authorization that replaces the previous one, which every
+     * RFC 6749 server honours. Declared, the re-authorization asks for the missing scope only and the stored granted
+     * set ACCUMULATES the previous consent with the new answer.
+     */
+    readonly incrementalConsent?: ProviderOAuth2IncrementalConsent;
+    /**
+     * Scopes a person cannot grant for themselves: only an administrator of the account can (#1671). Microsoft's
+     * application permissions and its admin-restricted delegated permissions are the case — "Application permissions
+     * always require admin consent", and a delegated permission that requires admin consent answers a user with "an
+     * 'unauthorized to consent' error".
+     * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — "Admin Consent for
+     * Application permissions" and "Admin Consent for Delegated Permissions", fetched 2026-09-27.
+     *
+     * Never put in a re-authorization request a person is sent to: an operation needing one is refused with the
+     * statement that an administrator must grant it, which is the only thing the person can act on.
+     */
+    readonly administratorConsentScopes?: readonly string[];
     /**
      * Env-var names resolving the APPLICATION's registration with the vendor. These are the two values
      * an operator genuinely does paste — they identify the integration, not the end user — and they
@@ -497,7 +626,7 @@ export interface ProviderRestOAuth2 {
      * spec-cite: RFC 6749 §3.3 (the scope parameter is a list of space-delimited, case-sensitive strings).
      *
      * Closed rather than free because a scope value can itself name a resource
-     * (`https://graph.microsoft.us/.default`), and a whole-scope placeholder with NO entry here cannot be
+     * (`https://graph.microsoft.com/.default`), and a whole-scope placeholder with NO entry here cannot be
      * answered at all. Derived by the transposer from the source's own dropdown; never guessed.
      */
     readonly scopeValueAllowances?: Readonly<Record<string, ProviderOAuth2ScopeValueAllowance>>;
@@ -528,7 +657,148 @@ export interface ProviderRestOAuth2 {
      * re-checked on every call that uses it.
      */
     readonly reportedAccountFacts?: Readonly<Record<string, ProviderOAuth2ReportedAccountFact>>;
+    /**
+     * The RESOURCE AUDIENCES one grant of this client can mint tokens for, keyed by audience id (#1725), and the
+     * HOSTS a token of each may be sent to.
+     *
+     * ## Why a grant needs more than one access token
+     *
+     * Microsoft issues an access token for ONE resource per request: the token redemption's scopes "must all be from a
+     * single resource", and a refresh request spanning several resources returns "a token for the resource specified
+     * in the first scope". A refresh token, though, is not tied to a resource: "A client can use a refresh token to
+     * acquire access tokens across any combination of resource and tenant where it has permission to do so." So a
+     * connection spanning Graph and Dataverse keeps ONE refresh token and mints a token per audience from it.
+     * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow — the `scope` rows
+     * of "Redeem a code for an access token" and "Refresh the access token"; and
+     * https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens — the opening section. Fetched 2026-09-27.
+     *
+     * ## Why the HOSTS are part of the declaration
+     *
+     * An access token is a bearer credential for its resource. Declaring which hosts receive a token of each audience is
+     * what lets the engine attach a token only to a request bound for its own resource (the token-host binding), so an
+     * operation — the base's own, a member's, or an augmentation's (#1672) — can never carry a Graph token to another
+     * host.
+     *
+     * Absent means the provider mints one token for one resource, which is every provider except a connection base that
+     * spans several. When present, {@link primaryAudience} names the audience the AUTHORIZATION grants — the resource of
+     * the connect request's scopes — whose token is the one stored with the grant; every other audience's token is minted
+     * from the refresh token on demand and cached, never stored.
+     */
+    readonly audiences?: Readonly<Record<string, ProviderRestOAuth2Audience>>;
+    /** The audience the authorization itself grants — see {@link audiences}. Required when `audiences` is declared. */
+    readonly primaryAudience?: string;
 }
+/** @wildo_source:part:start external-connectors.models.oauth2-audiences facet:layer:shared facet:family:provider facet:audience:app-developer */
+/** The placeholder a {@link ProviderRestOAuth2Audience.mintScopes} entry uses for the https origin of the request's host. */
+export declare const PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER = "{audienceOrigin}";
+/** One resource audience of a connection's grant. See {@link ProviderRestOAuth2.audiences}. */
+export interface ProviderRestOAuth2Audience {
+    /**
+     * The hosts a token of this audience may be sent to: exact lower-case hosts, and dotted suffixes admitting
+     * `<dns-labels><suffix>` (never the bare suffix). Every host is https.
+     */
+    readonly hosts: {
+        readonly values: readonly string[];
+        readonly hostSuffixes?: readonly string[];
+    };
+    /**
+     * The scopes that mint a token for this audience, all of ONE resource. An entry may begin with
+     * {@link PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER} — the https origin of the request's own host, admitted by
+     * {@link hosts} first — for a resource named per customer (a Dataverse environment's `<environment-url>/.default`).
+     */
+    readonly mintScopes: readonly string[];
+    /**
+     * The vendor's published limits for THIS resource (#1729) — see {@link ProviderRateBudgetDeclaration}. Per audience
+     * because each resource is metered by its own service: Graph's limits say nothing about a Dataverse environment.
+     */
+    readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[];
+}
+/** The audience a request host belongs to, with its id — see {@link selectProviderOAuth2AudienceForHost}. */
+export interface ProviderOAuth2AudienceSelection {
+    readonly id: string;
+    readonly audience: ProviderRestOAuth2Audience;
+    readonly primary: boolean;
+}
+/** Whether `host` is admitted by one audience's hosts: an exact value, or `<labels><suffix>` for a declared suffix. */
+export declare function providerOAuth2AudienceAdmitsHost(audience: ProviderRestOAuth2Audience, host: string): boolean;
+/**
+ * The ONE audience whose hosts admit `host`, or `undefined` when none does. The declaration guarantees at most one
+ * ({@link describeProviderOAuth2AudienceDefects} refuses overlapping hosts), so the answer never depends on order.
+ */
+export declare function selectProviderOAuth2AudienceForHost(oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience'>, host: string): ProviderOAuth2AudienceSelection | undefined;
+/**
+ * The scopes that mint `audience`'s token for a request to `origin` — `{audienceOrigin}` replaced by that origin.
+ * The caller has already admitted the origin's host through {@link selectProviderOAuth2AudienceForHost}; nothing a
+ * caller supplies reaches a scope any other way.
+ */
+export declare function resolveProviderOAuth2AudienceMintScopes(audience: ProviderRestOAuth2Audience, origin: string): readonly string[];
+/**
+ * The declared audience a scope a connection might REQUEST names (#1671): its id, or `undefined` when the scope names a
+ * resource none of the connection's audiences covers. Only meaningful when `audiences` is declared.
+ *
+ * A scope that is an absolute URI names the resource a token is minted for (`https://graph.microsoft.com/Mail.Send`,
+ * `https://contoso.crm.dynamics.com/user_impersonation`): the resource of one of an audience's fixed mint scopes (the
+ * mint scope without its last path segment), or — for a mint scope beginning `{audienceOrigin}` — an https origin whose
+ * host the audience admits. A scope that is not an absolute URI (`offline_access`, `Files.Read`) names no resource, and
+ * the vendor reads it against its default one, the PRIMARY audience: "omitting the resource identifier in the `scope`
+ * parameter defaults to Microsoft Graph".
+ * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — the note under
+ * "Admin Consent for Delegated Permissions", fetched 2026-09-27.
+ */
+export declare function findProviderOAuth2ScopeAudience(oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience'>, scope: string): string | undefined;
+/**
+ * Whether a scope a connection might REQUEST names a resource among the connection's declared audiences (#1671) — see
+ * {@link findProviderOAuth2ScopeAudience}. Asking a person to consent to it is asking them to let this application reach
+ * THAT resource, so a scope from a member ref or an opted-in augmentation (#1672) is requestable only when it names one
+ * the connection declares. `true` without looking further when the connection declares no audiences: it mints one token
+ * for one resource and its scopes are the vendor's own vocabulary (Google's scope URIs name permissions, not resources).
+ */
+export declare function providerOAuth2ScopeNamesDeclaredAudience(oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience'>, scope: string): boolean;
+/** @wildo_source:part:end external-connectors.models.oauth2-audiences */
+/** @wildo_source:part:start external-connectors.models.oauth2-incremental-consent facet:layer:shared facet:family:provider facet:audience:app-developer */
+/**
+ * How a vendor extends an existing delegated grant with more scopes — see {@link ProviderRestOAuth2.incrementalConsent}.
+ */
+export declare enum ProviderOAuth2IncrementalConsentForm {
+    /**
+     * The vendor keeps what the person already consented to, and a new authorization request naming only the added
+     * scopes ADDS them: Microsoft's delegated permissions "will be granted in addition to any other permissions that
+     * were already granted for that app (i.e. incremental)".
+     * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — "Incremental and
+     * dynamic user consent", fetched 2026-09-27.
+     */
+    ADDITIVE = "ADDITIVE",
+    /**
+     * The vendor adds the new scopes to the existing grant only when the request carries `include_granted_scopes=true`:
+     * "If you set this parameter's value to `true` and the authorization request is granted, then the new access token
+     * will also cover any scopes to which the user previously granted the application access."
+     * spec-cite: https://developers.google.com/identity/protocols/oauth2/web-server#incrementalAuth — the
+     * `include_granted_scopes` parameter row, fetched 2026-09-27.
+     */
+    INCLUDE_GRANTED_SCOPES = "INCLUDE_GRANTED_SCOPES"
+}
+/** A vendor's incremental-consent behaviour. See {@link ProviderRestOAuth2.incrementalConsent}. */
+export interface ProviderOAuth2IncrementalConsent {
+    readonly form: ProviderOAuth2IncrementalConsentForm;
+    /**
+     * Scopes every re-authorization request repeats beside the added ones — protocol scopes the answer needs rather than
+     * permissions (Microsoft's `offline_access`, without which a code redemption returns no refresh token). Each must be
+     * among the provider's declared {@link ProviderRestOAuth2.scopes}.
+     */
+    readonly restatedScopes?: readonly string[];
+}
+/** @wildo_source:part:end external-connectors.models.oauth2-incremental-consent */
+/**
+ * Why a declared audience set cannot be honoured, or an empty list. Checked where a provider is composed, so a
+ * malformed declaration never reaches a request:
+ * - `primaryAudience` names no declared audience, or is missing while audiences are declared;
+ * - the primary audience's mint scopes are not among the authorization's own `scopes` (its token is the one the
+ *   code redemption returns, so the authorization must be FOR that resource) or use the origin placeholder;
+ * - an audience with no host or no mint scope, a suffix without a leading dot, an origin placeholder anywhere but
+ *   the start of a scope, or any other `{placeholder}` in a mint scope;
+ * - two audiences admitting one host — a request host must select exactly one token.
+ */
+export declare function describeProviderOAuth2AudienceDefects(oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience' | 'scopes'>): string[];
 /** One vendor-reported account fact. See {@link ProviderRestOAuth2.reportedAccountFacts}. */
 export interface ProviderOAuth2ReportedAccountFact {
     /** Dot-path inside the token endpoint's JSON answer. A string or finite number there is the value. */
@@ -544,7 +814,39 @@ export interface ProviderOAuth2ReportedAccountFact {
 /** The values a whole-scope placeholder admits. See {@link ProviderRestOAuth2.scopeValueAllowances}. */
 export interface ProviderOAuth2ScopeValueAllowance {
     readonly values: readonly string[];
+    /** Values the vendor's source offers and the catalogue declines, matched exactly. See {@link ProviderOAuth2UnsupportedValues}. */
+    readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;
 }
+/**
+ * Values the vendor's OWN source offers for a placeholder and this catalogue deliberately does NOT admit, each mapped
+ * to the reason (#1937). Keyed by the value as the source writes it.
+ *
+ * Not a second allow-list: the admitted set (`values`, `hosts`) alone decides what is admitted, and a value found
+ * here is refused exactly as any other unadmitted value is (`VALUE_NOT_ADMITTED`, which also retires a STORED
+ * connection that carries it). What this adds is the WHY. A person who chose, or a connection that stored, a value
+ * the catalogue declined is told that it is unsupported and for what reason, instead of being handed a list of other
+ * values as though they had made a typing mistake.
+ *
+ * The first entry is the US Government Microsoft clouds (`login.microsoftonline.us`, GCC High and DoD), declared out
+ * of scope by product decision on 2026-09-29. The transposer writes these from the vendor record's declared
+ * exclusion (`_code_archive/providers/catalogue-record/vendors/<vendor>.json` since #2019 archived the catalogue; a
+ * registry provider adopted from it states them in its own module under `providers-registry/<ref>/`), so reversing a
+ * decision is record edits and a regeneration, never an engine change. How many edits depends on what the decline also removed: for the US
+ * Government clouds, three (the catalogue README lists them).
+ */
+export type ProviderOAuth2UnsupportedValues = Readonly<Record<string, string>>;
+/** How a placeholder's value is compared with a declared one. */
+export declare enum ProviderOAuth2ValueComparison {
+    /** A host or an origin: DNS names compare case-insensitively. spec-cite: RFC 4343 §2. */
+    CASE_INSENSITIVE = "CASE_INSENSITIVE",
+    /** A scope value: scope strings are case-sensitive. spec-cite: RFC 6749 §3.3. */
+    EXACT = "EXACT"
+}
+/**
+ * The declared reason a value is unsupported, or `undefined` when it is not declared unsupported. Compared as the
+ * placeholder's values are: case-insensitively for a host or origin, exactly for a scope value.
+ */
+export declare function findProviderOAuth2UnsupportedValueReason(unsupportedValues: ProviderOAuth2UnsupportedValues | undefined, value: string, comparison: ProviderOAuth2ValueComparison): string | undefined;
 /**
  * Where a `{placeholder}` sits inside one OAuth2 SCOPE entry. See {@link classifyProviderOAuth2ScopePlaceholder}.
  *
@@ -623,7 +925,7 @@ export declare enum ProviderOAuth2EndpointPlaceholderPosition {
 /** How a host- or origin-forming placeholder may be filled. See {@link ProviderRestOAuth2.endpointHostAllowances}. */
 export declare enum ProviderOAuth2EndpointHostAllowanceKind {
     /**
-     * Chosen at connect time from values the provider DECLARES — Microsoft's two login clouds,
+     * Chosen at connect time from values the provider DECLARES — Microsoft's commercial login cloud,
      * Zoho's data centres. A value outside the set is refused; a declared value is substituted
      * verbatim (it is a hostname or origin, not a path segment to encode).
      *
@@ -652,7 +954,22 @@ export declare enum ProviderOAuth2EndpointHostAllowanceKind {
      * The trade is explicit: the application serves the one vendor tenant (data centre) the operator
      * names. Admitted on a HOST placeholder that is the whole host, with a DNS-name value.
      */
-    DEPLOYMENT_CONFIGURED = "DEPLOYMENT_CONFIGURED"
+    DEPLOYMENT_CONFIGURED = "DEPLOYMENT_CONFIGURED",
+    /**
+     * DERIVED from another connect-time answer through a declared table (#1937): Microsoft Graph's operation host follows
+     * the login cloud the connection chose (`login.microsoftonline.com` → `graph.microsoft.com`), because a token minted by
+     * one national cloud is not accepted by another. The Microsoft source also maps the US Government login cloud; that
+     * row is declined (`unsupportedValues`), because US Government clouds are out of scope (decision of 2026-09-29).
+     *
+     * Never asked of a person and never taken from a request: the value is looked up from the ANSWER the connection
+     * stored for `answer`, and an answer the table does not name is refused. `whenUnanswered` is the host for a connection
+     * that answered nothing (the application's own pasted credential); absent, such a connection is refused. The table is
+     * the allow-list, so no other host can result. Admitted on a HOST placeholder that is the whole host.
+     *
+     * spec-cite: https://learn.microsoft.com/en-us/graph/deployments — "Access tokens acquired for a national cloud
+     * deployment are not interchangeable with those acquired for the global service or any other national cloud."
+     */
+    DERIVED_FROM_CONNECTION_ANSWER = "DERIVED_FROM_CONNECTION_ANSWER"
 }
 export type ProviderOAuth2EndpointHostAllowance = {
     readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DECLARED_VALUES;
@@ -674,6 +991,8 @@ export type ProviderOAuth2EndpointHostAllowance = {
      * connect as a deployment gap rather than minting a token nothing can use.
      */
     readonly originMatchesDeploymentBaseUrl?: true;
+    /** Values the vendor's source offers and the catalogue declines, with the reason. See {@link ProviderOAuth2UnsupportedValues}. */
+    readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;
 } | {
     readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_CONFIGURED;
     /**
@@ -682,6 +1001,19 @@ export type ProviderOAuth2EndpointHostAllowance = {
      * without which the runtime environment builder would strip it.
      */
     readonly envVarName: string;
+} | {
+    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DERIVED_FROM_CONNECTION_ANSWER;
+    /** The connect-time answer the host is derived from (`cloud`) — itself a placeholder of the same provider. */
+    readonly answer: string;
+    /** Per answer value (compared case-insensitively), the host it selects. DNS names. */
+    readonly hosts: Readonly<Record<string, string>>;
+    /** The host when the connection answered nothing; absent, an unanswered connection is refused. */
+    readonly whenUnanswered?: string;
+    /**
+     * ANSWER values the vendor's source maps to a host and the catalogue declines, with the reason — so a stored
+     * connection carrying one is refused at use naming why. See {@link ProviderOAuth2UnsupportedValues}.
+     */
+    readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;
 } | {
     readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_BASE_URL;
     /**

package/dist/esm/protocols/rest-operations.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-operations.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/protocols/rest-operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qDAAqD,CAAC;AAE7G,wJAAwJ;AACxJ,oDAAoD;AACpD,oBAAY,6BAA6B;IACvC,sGAAsG;IACtG,IAAI,SAAS;IACb,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED;;;;GAIG;AACH,oBAAY,+BAA+B;IACzC,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,SAAS,cAAc;IACvB,uFAAuF;IACvF,IAAI,SAAS;IACb;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,oBAAY,4BAA4B;IACtC,wFAAwF;IACxF,IAAI,SAAS;IACb,oGAAoG;IACpG,IAAI,SAAS;IACb,qGAAqG;IACrG,IAAI,SAAS;CACd;AAED;;;;GAIG;AACH,oBAAY,2BAA2B;IACrC,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,qFAAqF;IACrF,IAAI,SAAS;CACd;AAED,2FAA2F;AAC3F,MAAM,WAAW,8BAA8B;IAC7C,4FAA4F;IAC5F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,6BAA6B,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,gEAAgE;AAChE,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,+BAA+B,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,gHAAgH;IAChH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;IAC5C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,iCAAiC;IAChD,qHAAqH;IACrH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4HAA4H;IAC5H,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACvD;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,EAAE,gCAAgC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,8BAA8B,EAAE,CAAC;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,gCAAgC,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,4BAA4B,CAAC;IACzD,6GAA6G;IAC7G,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,+BAA+B,CAAC;IACtD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,iGAAiG;IACjG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC,CAAC;IACpF,kGAAkG;IAClG,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KACzC,CAAC;CACH;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,8BAA8B;IAC9B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;CACtE;AACD,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAC;AAEhH;;;;;;;;;GASG;AACH,MAAM,WAAW,yBAAyB;IACxC,2BAA2B;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE;QACd,4DAA4D;QAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,mEAAmE;QACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,4FAA4F;IAC5F,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAGD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,kBAAkB;IACjC,2GAA2G;IAC3G,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC,CAAC;IAChG;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC,CAAC;IAC5F;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC,CAAC;CAC7F;AAED,6FAA6F;AAC7F,MAAM,WAAW,iCAAiC;IAChD,sGAAsG;IACtG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,mCAAmC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAC,eAAe,CAAA;KAAE,CAAC,CAAC;CAC5I;AAED,wGAAwG;AACxG,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;GAKG;AACH,oBAAY,sCAAsC;IAChD;;;OAGG;IACH,MAAM,WAAW;IACjB;;;OAGG;IACH,WAAW,gBAAgB;CAC5B;AAED,6HAA6H;AAC7H,oBAAY,iCAAiC;IAC3C;;;;OAIG;IACH,gCAAgC,qCAAqC;IACrE,8GAA8G;IAC9G,oBAAoB,yBAAyB;IAC7C,iHAAiH;IACjH,WAAW,gBAAgB;CAC5B;AAED,4CAA4C;AAC5C,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sCAAsC,CAAC;IAC1D,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,iCAAiC,EAAE,CAYlH;AAED;;;;;GAKG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,GAAG,wCAAwC,GAAG,SAAS,CAQ1H;AASD;;;GAGG;AACH,wBAAgB,gDAAgD,CAAC,SAAS,EAAE,iCAAiC,GAAG,SAAS,MAAM,EAAE,CAUhI;AAED;;;GAGG;AACH,oBAAY,yCAAyC;IACnD;;;;OAIG;IACH,MAAM,WAAW;IACjB;;;;OAIG;IACH,IAAI,SAAS;IACb,oGAAoG;IACpG,aAAa,kBAAkB;CAChC;AAED,sHAAsH;AACtH,oBAAY,uCAAuC;IACjD;;;;;;;;;;;OAWG;IACH,eAAe,oBAAoB;IACnC;;;;;OAKG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;;;;;OASG;IACH,qBAAqB,0BAA0B;CAChD;AAED,MAAM,MAAM,mCAAmC,GAC3C;IACA,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAC,eAAe,CAAC;IACvE,qGAAqG;IACrG,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;;;;;;;;;OASG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,IAAI,CAAC;CAChD,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAC,qBAAqB,CAAC;IAC7E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAC,mBAAmB,CAAC;IAC3E;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC,CAAC;AAEJ,qEAAqE;AACrE,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,yCAAyC,CAAC;IAC7D,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;;GAGG;AACH,oBAAY,oCAAoC;IAC9C;;;;;OAKG;IACH,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;OAGG;IACH,iCAAiC,sCAAsC;IACvE;;;;;;OAMG;IACH,mBAAmB,wBAAwB;CAC5C;AAED;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,QAAsF,CAAC;AAEpI;;;;;;;GAOG;AACH,wBAAgB,kDAAkD,CAChE,WAAW,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,yCAAyC,CAAC;IAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,EACvJ,SAAS,EAAE,mCAAmC,GAC7C,SAAS,MAAM,EAAE,CA0DnB;AAED;;;GAGG;AACH,wBAAgB,yCAAyC,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,oCAAoC,EAAE,CAsB3H;AAED,2GAA2G;AAC3G,eAAO,MAAM,4CAA4C,QAAkC,CAAC;AAE5F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0CAA0C,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,2CAA2C,EAAE,CA2BnI;AAGD;;;;;;;;;;;;;;GAcG;AACH,oBAAY,yBAAyB;IACnC;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,8FAA8F;IAC9F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sCAAsC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACxC,UAAU,CAAC,EAAE,iCAAiC,KAC3C,OAAO,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"rest-operations.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/protocols/rest-operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qDAAqD,CAAC;AAE7G,wJAAwJ;AACxJ,oDAAoD;AACpD,oBAAY,6BAA6B;IACvC,sGAAsG;IACtG,IAAI,SAAS;IACb,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED;;;;GAIG;AACH,oBAAY,+BAA+B;IACzC,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,SAAS,cAAc;IACvB,uFAAuF;IACvF,IAAI,SAAS;IACb;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,oBAAY,4BAA4B;IACtC,wFAAwF;IACxF,IAAI,SAAS;IACb,oGAAoG;IACpG,IAAI,SAAS;IACb,qGAAqG;IACrG,IAAI,SAAS;CACd;AAED;;;;GAIG;AACH,oBAAY,2BAA2B;IACrC,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,qFAAqF;IACrF,IAAI,SAAS;CACd;AAED,2FAA2F;AAC3F,MAAM,WAAW,8BAA8B;IAC7C,4FAA4F;IAC5F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,6BAA6B,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,gEAAgE;AAChE,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,+BAA+B,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,gHAAgH;IAChH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;IAC5C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,iCAAiC;IAChD,qHAAqH;IACrH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4HAA4H;IAC5H,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACvD;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,iGAAiG;IACjG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,EAAE,gCAAgC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,8BAA8B,EAAE,CAAC;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,gCAAgC,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,4BAA4B,CAAC;IACzD,6GAA6G;IAC7G,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,+BAA+B,CAAC;IACtD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,iGAAiG;IACjG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC,CAAC;IACpF,kGAAkG;IAClG,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KACzC,CAAC;CACH;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,8BAA8B;IAC9B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrE;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC,CAAC;CACnF;AAED,uFAAuF;AACvF,MAAM,WAAW,gCAAgC;IAC/C,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AACD,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAC;AAEhH;;;;;;;;;GASG;AACH,MAAM,WAAW,yBAAyB;IACxC,2BAA2B;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE;QACd,4DAA4D;QAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,mEAAmE;QACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,wJAAwJ;AACxJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,2BAA2B;IACrC,oGAAoG;IACpG,UAAU,eAAe;IACzB,yHAAyH;IACzH,KAAK,UAAU;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,6BAA6B;IAC5C,2CAA2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0HAA0H;IAC1H,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAC;CACjD;AAED;;;;;GAKG;AACH,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAA;KAAE,CAAC,CAAC,CAAC;CACpH,GAAG,MAAM,EAAE,CAqBX;AAED;;;GAGG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAA;KAAE,CAAC;CACzF,GAAG,SAAS,6BAA6B,EAAE,CAE3C;AACD,gFAAgF;AAGhF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,kBAAkB;IACjC,2GAA2G;IAC3G,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gCAAgC,CAAC;IAC/D;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mCAAmC,CAAC,CAAC,CAAC;IAChG;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC,CAAC;IAC5F;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC,CAAC;IAC5F;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAC1E,mHAAmH;IACnH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,iJAAiJ;AACjJ,6HAA6H;AAC7H,eAAO,MAAM,2CAA2C,qBAAqB,CAAC;AAE9E,+FAA+F;AAC/F,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC3C,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;CACjE;AAED,6GAA6G;AAC7G,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,uHAAuH;AACvH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,0BAA0B,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ5G;AAED;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,iBAAiB,CAAC,EACjE,IAAI,EAAE,MAAM,GACX,+BAA+B,GAAG,SAAS,CAK7C;AAED;;;;GAIG;AACH,wBAAgB,uCAAuC,CAAC,QAAQ,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAI/H;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,iBAAiB,CAAC,EACjE,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAmBpB;AAED;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,iBAAiB,CAAC,EACjE,KAAK,EAAE,MAAM,GACZ,OAAO,CAIT;AACD,yEAAyE;AAEzE,2JAA2J;AAC3J;;GAEG;AACH,oBAAY,oCAAoC;IAC9C;;;;;;OAMG;IACH,QAAQ,aAAa;IACrB;;;;;;OAMG;IACH,sBAAsB,2BAA2B;CAClD;AAED,mGAAmG;AACnG,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,oCAAoC,CAAC;IACpD;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AACD,mFAAmF;AAEnF;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,iBAAiB,GAAG,QAAQ,CAAC,GAAG,MAAM,EAAE,CAwC5I;AAED,6FAA6F;AAC7F,MAAM,WAAW,iCAAiC;IAChD,sGAAsG;IACtG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,mCAAmC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAC,eAAe,CAAA;KAAE,CAAC,CAAC;CAC5I;AAED,wGAAwG;AACxG,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kIAAkI;IAClI,QAAQ,CAAC,iBAAiB,CAAC,EAAE,+BAA+B,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/E,iEAAiE;AACjE,oBAAY,6BAA6B;IACvC,yFAAyF;IACzF,gBAAgB,qBAAqB;IACrC,iFAAiF;IACjF,KAAK,UAAU;CAChB;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,iBAAiB,EAAE,+BAA+B,GAAG,SAAS,EAC9D,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,6BAA6B,GACxC,MAAM,GAAG,SAAS,CAMpB;AAsBD;;;;;GAKG;AACH,oBAAY,sCAAsC;IAChD;;;OAGG;IACH,MAAM,WAAW;IACjB;;;OAGG;IACH,WAAW,gBAAgB;CAC5B;AAED,6HAA6H;AAC7H,oBAAY,iCAAiC;IAC3C;;;;OAIG;IACH,gCAAgC,qCAAqC;IACrE,8GAA8G;IAC9G,oBAAoB,yBAAyB;IAC7C,iHAAiH;IACjH,WAAW,gBAAgB;CAC5B;AAED,4CAA4C;AAC5C,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sCAAsC,CAAC;IAC1D,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,iCAAiC,EAAE,CAYlH;AAED;;;;;GAKG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,GAAG,wCAAwC,GAAG,SAAS,CAQ1H;AASD;;;GAGG;AACH,wBAAgB,gDAAgD,CAAC,SAAS,EAAE,iCAAiC,GAAG,SAAS,MAAM,EAAE,CAWhI;AAED;;;GAGG;AACH,oBAAY,yCAAyC;IACnD;;;;OAIG;IACH,MAAM,WAAW;IACjB;;;;OAIG;IACH,IAAI,SAAS;IACb,oGAAoG;IACpG,aAAa,kBAAkB;CAChC;AAED,sHAAsH;AACtH,oBAAY,uCAAuC;IACjD;;;;;;;;;;;OAWG;IACH,eAAe,oBAAoB;IACnC;;;;;OAKG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;;;;;OASG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;;;;;;;;OAaG;IACH,8BAA8B,mCAAmC;CAClE;AAED,MAAM,MAAM,mCAAmC,GAC3C;IACA,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAC,eAAe,CAAC;IACvE,qGAAqG;IACrG,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;;;;;;;;;OASG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,IAAI,CAAC;IAC/C,kIAAkI;IAClI,QAAQ,CAAC,iBAAiB,CAAC,EAAE,+BAA+B,CAAC;CAC9D,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAC,qBAAqB,CAAC;IAC7E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAC,8BAA8B,CAAC;IACtF,8GAA8G;IAC9G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,kGAAkG;IAClG,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,+BAA+B,CAAC;CAC9D,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAC,mBAAmB,CAAC;IAC3E;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC,CAAC;AAEJ,qEAAqE;AACrE,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,yCAAyC,CAAC;IAC7D,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;;GAGG;AACH,oBAAY,oCAAoC;IAC9C;;;;;OAKG;IACH,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,qBAAqB,0BAA0B;IAC/C;;;OAGG;IACH,iCAAiC,sCAAsC;IACvE;;;;;;OAMG;IACH,mBAAmB,wBAAwB;CAC5C;AAED;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,QAAsF,CAAC;AAEpI;;;;;;;GAOG;AACH,wBAAgB,kDAAkD,CAChE,WAAW,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,yCAAyC,CAAC;IAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,EACvJ,SAAS,EAAE,mCAAmC,GAC7C,SAAS,MAAM,EAAE,CA+EnB;AAED;;;GAGG;AACH,wBAAgB,yCAAyC,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,oCAAoC,EAAE,CAsB3H;AAED,2GAA2G;AAC3G,eAAO,MAAM,4CAA4C,QAAkC,CAAC;AAE5F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0CAA0C,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,2CAA2C,EAAE,CA2BnI;AAGD;;;;;;;;;;;;;;GAcG;AACH,oBAAY,yBAAyB;IACnC;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,8FAA8F;IAC9F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sCAAsC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACxC,UAAU,CAAC,EAAE,iCAAiC,KAC3C,OAAO,CAAC,OAAO,CAAC,CAAC"}