@wildo-ai/external-connectors-models 1.1.9 → 1.1.11

package/dist/esm/protocols/rest-operations.external-connectors-models.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"rest-operations.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/rest-operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAQH,wJAAwJ;AACxJ,oDAAoD;AACpD,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,sGAAsG;IACtG,8CAAa,CAAA;IACb,gDAAe,CAAA;IACf,kDAAiB,CAAA;AACnB,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,+BAaX;AAbD,WAAY,+BAA+B;IACzC,gDAAa,CAAA;IACb,sEAAmC,CAAA;IACnC,0DAAuB,CAAA;IACvB,uFAAuF;IACvF,gDAAa,CAAA;IACb;;;;;OAKG;IACH,oDAAiB,CAAA;AACnB,CAAC,EAbW,+BAA+B,KAA/B,+BAA+B,QAa1C;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,4BAOX;AAPD,WAAY,4BAA4B;IACtC,wFAAwF;IACxF,6CAAa,CAAA;IACb,oGAAoG;IACpG,6CAAa,CAAA;IACb,qGAAqG;IACrG,6CAAa,CAAA;AACf,CAAC,EAPW,4BAA4B,KAA5B,4BAA4B,QAOvC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,2BAMX;AAND,WAAY,2BAA2B;IACrC,gDAAiB,CAAA;IACjB,4CAAa,CAAA;IACb,gDAAiB,CAAA;IACjB,qFAAqF;IACrF,4CAAa,CAAA;AACf,CAAC,EANW,2BAA2B,KAA3B,2BAA2B,QAMtC;AA4QD,wJAAwJ;AACxJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,oGAAoG;IACpG,wDAAyB,CAAA;IACzB,yHAAyH;IACzH,8CAAe,CAAA;AACjB,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAwBD;;;;;GAKG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,yCAAmB,CAAA;AACrB,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAAC,KAGjD;IACC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,YAAkE,EAAQ,EAAE;QACxG,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,iDAAiD,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACrH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;gBAClF,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,yCAAyC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/G,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChF,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,gBAAgB,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;YACvH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;QAAE,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClG,OAAO,CAAC,IAAI,CAAC,gIAAgI,CAAC,CAAC;IACjJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAGpD;IACC,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC;AAC3G,CAAC;AA8PD,iJAAiJ;AACjJ,6HAA6H;AAC7H,MAAM,CAAC,MAAM,2CAA2C,GAAG,kBAAkB,CAAC;AAgC9E,uHAAuH;AACvH,MAAM,UAAU,gCAAgC,CAAC,QAAoC,EAAE,IAAY;IACjG,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1F,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACtF,OAAO,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mCAAmC,CACjD,MAAiE,EACjE,IAAY;IAEZ,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,gCAAgC,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;IACxH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uCAAuC,CAAC,QAAoC,EAAE,MAAc;IAC1G,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,2CAA2C,CAAC;QACtG,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,MAAM,CAAC,EAAE;QAC/E,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAiE,EACjE,KAAa;IAEb,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC;IAC3E,qHAAqH;IACrH,mHAAmH;IACnH,oDAAoD;IACpD,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,SAAS,CAAC,UAAU,CAAC,2CAA2C,CAAC,EAAE,CAAC;gBACtE,IAAI,IAAI,KAAK,SAAS,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gCAAgC,CAAC,QAAQ,EAAE,IAAI,CAAC;oBAAE,OAAO,EAAE,CAAC;gBACrI,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CACtD,MAAiE,EACjE,KAAa;IAEb,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,+BAA+B,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,SAAS,CAAC;AACtE,CAAC;AACD,yEAAyE;AAEzE,2JAA2J;AAC3J;;GAEG;AACH,MAAM,CAAN,IAAY,oCAiBX;AAjBD,WAAY,oCAAoC;IAC9C;;;;;;OAMG;IACH,6DAAqB,CAAA;IACrB;;;;;;OAMG;IACH,yFAAiD,CAAA;AACnD,CAAC,EAjBW,oCAAoC,KAApC,oCAAoC,QAiB/C;AAYD,mFAAmF;AAEnF;;;;;;;;;GASG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAA4E;IAChI,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,eAAe,iCAAiC,CAAC,CAAC;IACnI,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACrG,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,8BAA8B,CAAC,CAAC;IAC1H,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;QAC5I,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,+BAA+B,MAAM,+BAA+B,CAAC,CAAC;QAC1M,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,wBAAwB,KAAK,4BAA4B,CAAC,CAAC;QAC1J,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAC;QAC9F,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrJ,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,KAAK,gDAAgD,2CAA2C,EAAE,CAAC,CAAC;QACjM,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,UAAU,CAAC,2CAA2C,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,eAAe,iBAAiB,KAAK,gFAAgF,CAAC,CAAC;iBAClO,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,eAAe,iBAAiB,KAAK,+CAA+C,CAAC,CAAC;QACtL,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACpD,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAE,CAAC;YAC9C,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;YACjD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;mBAC1G,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;mBAC/F,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;YAClO,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,cAAc,MAAM,UAAU,OAAO,6DAA6D,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAuCD,iEAAiE;AACjE,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,yFAAyF;IACzF,sEAAqC,CAAA;IACrC,iFAAiF;IACjF,gDAAe,CAAA;AACjB,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,iBAA8D,EAC9D,KAAa,EACb,UAAyC;IAEzC,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,GAAG,GAAG,UAAU,KAAK,6BAA6B,CAAC,KAAK;QAC5D,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACxG,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,6CAA6C,CACpD,iBAA8D,EAC9D,QAA2B,EAC3B,UAAyC;IAEzC,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,CAAC,UAAU,KAAK,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAChI,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,6CAA6C,CAAC,CAAC;QAC5G,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,KAAK,oBAAoB,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sCAWX;AAXD,WAAY,sCAAsC;IAChD;;;OAGG;IACH,2DAAiB,CAAA;IACjB;;;OAGG;IACH,qEAA2B,CAAA;AAC7B,CAAC,EAXW,sCAAsC,KAAtC,sCAAsC,QAWjD;AAED,6HAA6H;AAC7H,MAAM,CAAN,IAAY,iCAWX;AAXD,WAAY,iCAAiC;IAC3C;;;;OAIG;IACH,0GAAqE,CAAA;IACrE,8GAA8G;IAC9G,kFAA6C,CAAA;IAC7C,iHAAiH;IACjH,gEAA2B,CAAA;AAC7B,CAAC,EAXW,iCAAiC,KAAjC,iCAAiC,QAW5C;AAUD;;;GAGG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAAa;IAClE,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,4CAA4C,CAAC,CAAC,CAAC;IACtF,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,4CAA4C,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAwC,EAAE,CAAC;IACxD,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,WAAW,CAAC,CAAC;IACxI,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,oBAAoB,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,gCAAgC,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAAa;IAClE,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE;QACf,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,WAAW,CAAC,CAAC,CAAC,sCAAsC,CAAC,MAAM;QAC/I,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;KAChB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,mCAAmC,GAAG,qCAAqC,CAAC;AAElF;;;GAGG;AACH,MAAM,UAAU,gDAAgD,CAAC,SAA4C;IAC3G,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,wCAAwC,CAAC,CAAC;IACzH,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjI,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,6CAA6C,CAAC,SAAS,CAAC,iBAAiB,EAAE,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC;IACnJ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,yCAeX;AAfD,WAAY,yCAAyC;IACnD;;;;OAIG;IACH,8DAAiB,CAAA;IACjB;;;;OAIG;IACH,0DAAa,CAAA;IACb,oGAAoG;IACpG,4EAA+B,CAAA;AACjC,CAAC,EAfW,yCAAyC,KAAzC,yCAAyC,QAepD;AAED,sHAAsH;AACtH,MAAM,CAAN,IAAY,uCA+CX;AA/CD,WAAY,uCAAuC;IACjD;;;;;;;;;;;OAWG;IACH,8EAAmC,CAAA;IACnC;;;;;OAKG;IACH,sFAA2C,CAAA;IAC3C;;;;;;;;;OASG;IACH,0FAA+C,CAAA;IAC/C;;;;;;;;;;;;;OAaG;IACH,4GAAiE,CAAA;AACnE,CAAC,EA/CW,uCAAuC,KAAvC,uCAAuC,QA+ClD;AAoFD;;;GAGG;AACH,MAAM,CAAN,IAAY,oCA2BX;AA3BD,WAAY,oCAAoC;IAC9C;;;;;OAKG;IACH,6FAAqD,CAAA;IACrD;;;;OAIG;IACH,uFAA+C,CAAA;IAC/C;;;OAGG;IACH,+GAAuE,CAAA;IACvE;;;;;;OAMG;IACH,mFAA2C,CAAA;AAC7C,CAAC,EA3BW,oCAAoC,KAApC,oCAAoC,QA2B/C;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,mFAAmF,CAAC;AAEpI;;;;;;;GAOG;AACH,MAAM,UAAU,kDAAkD,CAChE,WAAuJ,EACvJ,SAA8C;IAE9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,aAAa,EAAE,CAAC;QACrF,OAAO,CAAC,qDAAqD,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,uCAAuC,CAAC,mBAAmB,EAAE,CAAC;QACnF,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,MAAM,EAAE,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,sBAAsB,SAAS,CAAC,iBAAiB,4EAA4E,CAAC,CAAC;QAC9I,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,uCAAuC,CAAC,8BAA8B,EAAE,CAAC;QAC9F,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/F,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QACtH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,6CAA6C,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,6BAA6B,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAChL,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,uCAAuC,CAAC,qBAAqB,EAAE,CAAC;QACrF,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,kDAAkD,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,8BAA8B,KAAK,IAAI,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,MAAM,EAAE,CAAC;QACnI,OAAO,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,MAAM,EAAE,CAAC;YAC9E,iGAAiG;YACjG,mGAAmG;YACnG,oCAAoC;YACpC,MAAM,KAAK,GAAG,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,4DAA4D,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAClD,6FAA6F;QAC7F,6EAA6E;QAC7E,gHAAgH;QAChH,oGAAoG;QACpG,MAAM,uBAAuB,GAAG,WAAW,CAAC,iBAAiB,KAAK,SAAS,IAAI,WAAW,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QACpJ,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC1I,OAAO,CAAC,IAAI,CAAC,gBAAgB,MAAM,+CAA+C,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,gBAAgB,MAAM,sGAAsG,CAAC,CAAC;QAC7I,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,6CAA6C,CAAC,SAAS,CAAC,iBAAiB,EAAE,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9J,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,8FAA8F;QAC9F,MAAM,cAAc,GAAG,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC9H,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,kDAAkD,cAAc,aAAa,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yCAAyC,CAAC,QAAgB;IACxE,MAAM,OAAO,GAA2C,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACnE,OAAO,CAAC,oCAAoC,CAAC,wBAAwB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,qBAAqB,CAAC,CAAC;IAC5I,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACtF,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,mBAAmB,CAAC,CAAC;YACvE,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC,QAAQ,CAAC;aAC1E,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,CAAC,CAAC;QAClG,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,iCAAiC,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,4CAA4C,GAAG,+BAA+B,CAAC;AAE5F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,0CAA0C,CAAC,QAAgB;IACzE,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,YAAY,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,GAAG,GAAG,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,GAAkD,EAAE,CAAC;IACtE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,4CAA4C,CAAC,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC;YAC1B,CAAC,CAAC,yCAAyC,CAAC,MAAM;YAClD,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,KAAK,GAAG,eAAe,IAAI,KAAK,GAAG,YAAY;gBACvE,CAAC,CAAC,yCAAyC,CAAC,IAAI;gBAChD,CAAC,CAAC,yCAAyC,CAAC,aAAa,CAAC;QAC9D,MAAM,iBAAiB,GAAG,QAAQ,KAAK,yCAAyC,CAAC,IAAI;eAChF,KAAK,KAAK,eAAe,GAAG,CAAC;eAC7B,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC;QAC9C,MAAM,gBAAgB,GAAG,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,iBAAiB,IAAI,KAAK,KAAK,eAAe,GAAG,CAAC;YACzI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC;YACvD,CAAC,CAAC,SAAS,CAAC;QACd,mHAAmH;QACnH,MAAM,iBAAiB,GAAG,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/J,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;IAChK,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAGD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAN,IAAY,yBAeX;AAfD,WAAY,yBAAyB;IACnC;;;;;OAKG;IACH,oDAAuB,CAAA;IACvB;;;;;OAKG;IACH,kEAAqC,CAAA;AACvC,CAAC,EAfW,yBAAyB,KAAzB,yBAAyB,QAepC","sourcesContent":["/**\n * The REST OPERATION vocabulary — what an operation IS, independent of who executes one.\n *\n * Moved here from `@wildo-ai/external-connectors-private/backend` on 2026-09-06 (#378), and the\n * reason is a measurement rather than tidiness. A generated provider's operation catalogue is loaded\n * LAZILY on purpose: the loader contract forbids evaluating it at boot, because a provider whose\n * operations are eager puts every vendor's operations into every process's boot graph. But the\n * catalogue module needs `ProviderRestParameterLocation` and `ProviderRestRequestBodyEncoding` as\n * VALUES, and their only public door was the backend barrel — so reading two string enums pulled the\n * entire backend provider surface in behind them:\n *\n * | import | heap | time |\n * |---|---|---|\n * | `@wildo-ai/external-connectors-models` | 20.8 MB | 39 ms |\n * | `@wildo-ai/external-connectors-private/backend` | 160.7 MB | 251 ms |\n *\n * 161 MB to answer \"is this parameter in the path or the query\". The vocabulary belongs here for a\n * reason that survives the measurement, too: it describes what an operation IS — its method, its\n * path template, where its parameters ride — and none of that is backend runtime. The arrow already\n * pointed this way, since this package has no dependency on the private backend and the private\n * backend depends on it.\n *\n * ## This is the ONLY description of a REST provider — two earlier ones were deleted\n *\n * `rest-api.external-connectors-models.schemas.ts` described REST providers twice over, and both\n * descriptions are gone. Neither should come back beside this module.\n *\n * - **An OpenAPI-shaped operation layer** (`REST_API_OperationSpecSchema`,\n *   `REST_API_OperationContextSchema`, `REST_API_OperationDefinition`, `API_Parameter*`,\n *   `API_ContentType`) — deleted 2026-09-06 by #331. Ten exported symbols and zero code readers: a\n *   provider that authored one compiled, shipped, and was invisible to every runtime.\n * - **A profile / configuration / status triple** (`REST_API_Provider_Profile`,\n *   `REST_API_Provider_Configuration`, `REST_APIProvider_StatusSchema`) — deleted 2026-09-12 (#18).\n *   Its only reader was the `ExternalProvider_ExchangeProtocol` union, itself read by nothing but a\n *   drift test pinning it to the enum, and deleted in the same change. Its `pagination.style` was an\n *   anonymous `\"offset\" | \"cursor\" | \"page\" | \"link\"` restating {@link ProviderRestPaginationStyle}.\n *\n * WHERE a REST API lives and how it authenticates is the `rest` arm of the backend runtime contract\n * (`@wildo-ai/external-connectors-private/backend`); WHAT can be called against it is\n * {@link ProviderRestOperation}, executed by `ProviderOperationExecutorBackendService`. A second\n * description of either is not a missing feature — it is the drift that makes an authoring surface\n * untrustworthy, because an author cannot tell which of two shapes is the one that runs. If an\n * OpenAPI document is ever read (a second mapper input), it feeds `ProviderRestOperation` like\n * every other source.\n */\n\nimport { z } from 'zod';\n\nimport { API_HttpMethod } from '../core/commons.external-connectors-models.schemas';\nimport { ExternalOperation_Classification } from '../core/operation-classification.external-connectors-models.schemas';\nimport type { ExternalProvider_ConnectionTarget } from '../core/security.external-connectors-models.schemas';\n\n/** @wildo_source:part:start external-connectors.models.rest-operation-contract facet:layer:shared facet:family:provider facet:audience:app-developer */\n/** Where a declared parameter rides on the wire. */\nexport enum ProviderRestParameterLocation {\n  /** Substituted into a `{token}` of the path template. Always required — a path cannot have a hole. */\n  PATH = 'path',\n  QUERY = 'query',\n  HEADER = 'header',\n}\n\n/**\n * How the request body is encoded. The ETL read surface only ever needed JSON; a hand-authored\n * write reaches vendors that take form bodies (OAuth-adjacent endpoints, older CRMs) and file\n * uploads, so the encoding is DECLARED per operation rather than inferred from the method.\n */\nexport enum ProviderRestRequestBodyEncoding {\n  JSON = 'json',\n  FORM_URLENCODED = 'form-urlencoded',\n  MULTIPART = 'multipart',\n  /** A raw text body; `contentType` on the declaration says which media type is sent. */\n  TEXT = 'text',\n  /**\n   * Raw bytes (#367, folding #364) — an image, a PDF, a file upload a vendor takes as the whole body.\n   * `contentType` is REQUIRED, by the TEXT arm's rule: a body without its media type is not addressable.\n   * The input must supply a `Uint8Array` (a Node `Buffer` is one); nothing is converted into bytes here,\n   * because a string encoded under a guessed charset is exactly how an upload arrives corrupted.\n   */\n  BINARY = 'binary',\n}\n\n/**\n * How the vendor's ANSWER is read (#367, folding #364).\n *\n * The request side could already send TEXT and the transport could already read TEXT and NONE, while\n * the operation declaration could only say JSON — so an operation against a `text/csv` export could be\n * authored and then failed at runtime as `INVALID_JSON`, a contract-breach message for a declaration\n * the contract had no way to state. This is the missing half of that asymmetry.\n */\nexport enum ProviderRestResponseDecoding {\n  /** Parse the body as JSON. The default, and what an absent `responseDecoding` means. */\n  JSON = 'json',\n  /** Keep the body as text — a CSV export, an XML document. The operation's output is that string. */\n  TEXT = 'text',\n  /** Read nothing — a write whose answer carries no information (a 204). The output is `undefined`. */\n  NONE = 'none',\n}\n\n/**\n * How a listing operation continues. A HINT the caller reads, never something the executor acts\n * on: an executor that paged on its own would decide a caller's memory budget for it, and the\n * ETL lane already owns paging as a discipline (drift-safe continuation only).\n */\nexport enum ProviderRestPaginationStyle {\n  OFFSET = 'offset',\n  PAGE = 'page',\n  CURSOR = 'cursor',\n  /** The vendor returns its own continuation URL (`@odata.nextLink`, `links.next`). */\n  LINK = 'link',\n}\n\n/** One declared parameter: a wire name, where it rides, and which input field feeds it. */\nexport interface ProviderRestOperationParameter {\n  /** The name ON THE WIRE (`page_size`, `X-Vendor-Version`, or the `{token}` in the path). */\n  readonly name: string;\n  readonly in: ProviderRestParameterLocation;\n  /**\n   * The INPUT field that feeds it, when the two differ (`pageSize` → `page_size`). Absent means\n   * the input field is spelled exactly like the wire name. Declared, never camel/snake-guessed:\n   * a guess that is wrong drops a parameter silently and the vendor answers a valid-looking\n   * default page.\n   */\n  readonly from?: string;\n  /** PATH parameters are required whatever this says; for QUERY/HEADER, absent means optional. */\n  readonly required?: boolean;\n  /** A literal value sent on every call — for a version pin or a fixed format selector. */\n  readonly constantValue?: string;\n  readonly description?: string;\n}\n\n/** How the request body is built from the operation's input. */\nexport interface ProviderRestOperationRequestBody {\n  readonly encoding: ProviderRestRequestBodyEncoding;\n  /**\n   * The input field carrying the whole body. Absent = the body is every input field NOT consumed\n   * by a declared parameter — the ordinary shape, and the reason parameters declare `from`.\n   */\n  readonly from?: string;\n  /** For `TEXT` and `BINARY`: the media type actually sent (`text/csv`, `application/pdf`). Required for both. */\n  readonly contentType?: string;\n  /**\n   * A JSON body sent INSIDE one named property: `envelope: 'data'` sends `{ \"data\": { …the body… } }` (#333).\n   *\n   * Asana answers `data: Missing input` to a task whose fields arrive at the top level — its API reads\n   * every write from a `data` wrapper, which the source catalogue builds in its request helper and the\n   * transposer never saw. Declared here rather than modelled as a nested input, so the INPUT stays flat:\n   * the fields a person fills in, and the fields an `inputOptions` key names, are the fields they see.\n   *\n   * JSON only. Any other encoding with an envelope is refused by name when the request is compiled — a\n   * form, text or binary body has no property to wrap it in.\n   */\n  readonly envelope?: string;\n}\n\n/** Where the payload sits inside a response, and how a listing continues. */\nexport interface ProviderRestOperationPagination {\n  readonly style: ProviderRestPaginationStyle;\n  /** OFFSET/PAGE/CURSOR: the request parameter names the caller advances. */\n  readonly limitParam?: string;\n  readonly offsetParam?: string;\n  readonly pageParam?: string;\n  readonly cursorParam?: string;\n  /** CURSOR/LINK: dot-path in the RESPONSE carrying the next cursor or the next URL. */\n  readonly nextPath?: string;\n}\n\n/**\n * Where an input's CHOICES come from: another operation of the same provider, run through the SAME\n * connection, whose answer lists the values a person may pick (#333).\n *\n * The shape every workflow product converged on, and deliberately not a value stored on the connection.\n * A workspace, a project, a channel are choices WITHIN an account, made per call: Zapier fills a\n * dynamic dropdown with \"a live API call\", Make fills a module field through an RPC that \"must have the\n * same connection\", n8n's resource locator lists through the node's credentials, and the Activepieces\n * source this catalogue is scraped from declares Asana's workspace as a required dropdown whose options\n * are fetched with the connected account. A connection records only what the vendor REPORTED when it\n * was authorized ({@link ProviderRestOAuth2.accountRefResponsePath}).\n *\n * Declaring an options source does not make the options operation reachable from a browser: it is its\n * own operation, and `providers.browserOperations` must list it like any other.\n *\n * @example\n * // Asana: a task's project is chosen from the projects of the chosen workspace.\n * inputOptions: {\n *   workspace: { operationId: 'list_workspaces', valuePath: 'gid', labelPath: 'name' },\n *   project: { operationId: 'list_projects', valuePath: 'gid', labelPath: 'name', dependsOn: { workspace: 'workspace' } },\n * }\n */\nexport interface ProviderRestOperationInputOptions {\n  /** The operation that lists the choices. Same provider; its output (after its own `resultPath`) must be an array. */\n  readonly operationId: string;\n  /** That operation's catalogue domain, when it differs from the one being called. */\n  readonly domain?: string;\n  /** Dot-path, inside each listed item, to the value the input receives (`gid`). */\n  readonly valuePath: string;\n  /** Dot-path, inside each listed item, to the text a person reads (`name`). Vendor content, never derived from the value. */\n  readonly labelPath: string;\n  /**\n   * Inputs the options depend on: `{ <options-operation input field>: <this operation's input field> }`.\n   * A choice that is not yet made is REFUSED by name rather than listed as empty — \"no projects\" and\n   * \"choose a workspace first\" are different answers, and only one of them is true.\n   */\n  readonly dependsOn?: Readonly<Record<string, string>>;\n}\n\n/**\n * A provider operation, hand-authored. The unit an application addresses:\n * `executeProviderOperation({ providerRef: 'slack', operationId: 'conversations.list', input })`.\n */\nexport interface ProviderRestOperation {\n  /** Unique within the provider, and the address an ETL binding reference uses. */\n  readonly operationId: string;\n  /**\n   * The lazy-load unit. `operations('conversations')` answers only this domain's operations, so a\n   * vendor with hundreds need not evaluate them all to run one.\n   */\n  readonly domain: string;\n  readonly method: API_HttpMethod;\n  /** Relative to the provider's base URL. `{token}` interpolates a PATH parameter of that name. */\n  readonly pathTemplate: string;\n  readonly summary?: string;\n  /**\n   * Whether the operation MUTATES the vendor.\n   *\n   * ONE vocabulary for every operation catalogue, whatever produced it: a hand-authored operation\n   * and a generated one are the same concept, and two enums over the same two values is precisely\n   * the drift D1 exists to remove. Read by an ETL binding reference (which refuses to serve a read\n   * surface from a WRITE), by the audit trail as the axis a reviewer filters on first, and by a UI\n   * deciding whether to confirm.\n   *\n   * The name carried a source catalogue's spelling until 2026-09-06 and no longer does — an\n   * operation's EFFECT is not a property of where its definition came from.\n   */\n  readonly classification: ExternalOperation_Classification;\n  readonly parameters?: readonly ProviderRestOperationParameter[];\n  readonly requestBody?: ProviderRestOperationRequestBody;\n  /**\n   * Zod schema the caller's input is parsed through BEFORE anything is compiled. A typed client\n   * (S3b) derives its argument type from it. Absent = the input is passed through unvalidated,\n   * which is legal for a thin wrapper and honest about carrying no contract.\n   */\n  readonly inputSchema?: z.ZodType;\n  /**\n   * Zod schema the RESPONSE is parsed through. Absent = the parsed body is returned as `unknown`.\n   * A vendor adding a field must never break a call, so authors should keep these permissive; the\n   * value is in naming the fields a caller may rely on, not in policing the vendor.\n   */\n  readonly outputSchema?: z.ZodType;\n  /**\n   * How the answer is read. Absent = `JSON`, so every operation authored before this field existed\n   * reads exactly as it did.\n   *\n   * It also sets the default `Accept` header — `application/json` for JSON, `*\\/*` otherwise — which a\n   * declared `Accept` HEADER parameter overrides when a vendor needs a specific media type.\n   *\n   * Two combinations are refused by name when the request is compiled, because each describes a payload\n   * that cannot exist: `resultPath` beside `TEXT` or `NONE` (there is no structure to walk), and\n   * `outputSchema` beside `NONE` (there is nothing to parse). `outputSchema` beside `TEXT` is legal and\n   * validates the string.\n   */\n  readonly responseDecoding?: ProviderRestResponseDecoding;\n  /** Dot-path to the payload inside the response body. Absent = the body IS the payload. JSON answers only. */\n  readonly resultPath?: string;\n  readonly pagination?: ProviderRestOperationPagination;\n  /**\n   * OAuth scopes (or vendor permission names) the credential must carry, as the exact strings the vendor\n   * grants. CHECKED before the request leaves (#979): `ProviderOperationExecutorBackendService` compares them\n   * with the scopes recorded on the spent grant and refuses with the missing ones named when any is absent.\n   * A grant that records no scopes (a pasted key, a vendor that does not echo `scope`) proceeds, and the\n   * call's audit row says the check could not be made — refusing there would break every such vendor.\n   *\n   * Until 2026-09-14 this said \"declared and not checked\"; checking needed the granted set on the grant,\n   * which the connected-accounts lane now stores. Two things not to confuse it\n   * with: `ProviderRestOAuth2.scopes` is the vendor's ADVISORY default set, and the wildo-cli\n   * `getProviderApiKey({ requiredScopes })` parameter is a list of secret-contract SLUGS — a\n   * different concept sharing the name, which no production caller feeds from this field. As of\n   * 2026-09-12 no generated provider declares it either.\n   */\n  readonly requiredScopes?: readonly string[];\n  /**\n   * Whether re-sending this request is safe. Absent = derived from the method: GET, HEAD, OPTIONS,\n   * PUT and DELETE are idempotent, POST and PATCH are not.\n   * spec-cite: RFC 9110 §9.2.2 (PUT, DELETE and the safe methods are idempotent) and §9.2.1\n   * (GET, HEAD, OPTIONS, TRACE are safe).\n   * Declare it TRUE on a POST the vendor documents as idempotent (an idempotency-key endpoint);\n   * declaring it wrongly is how a retried timeout charges a customer twice.\n   */\n  readonly idempotent?: boolean;\n  /** Narrows the provider's semantics for this one operation (a slow export, a tight endpoint). */\n  readonly remoteCallSemantics?: Partial<ProviderRestCallSemantics>;\n  /**\n   * Where each input's choices come from, keyed by INPUT field name. Absent for an input a caller types.\n   * See {@link ProviderRestOperationInputOptions}.\n   */\n  readonly inputOptions?: Readonly<Record<string, ProviderRestOperationInputOptions>>;\n  /** Set when the vendor has deprecated it; the executor logs once per operation, never refuses. */\n  readonly deprecated?: {\n    readonly reason: string;\n    readonly since?: string;\n    readonly replacedByOperationId?: string;\n  };\n}\n\n/** What one `operations(domain?)` call answers. */\nexport interface ProviderRestOperationCatalogue {\n  /** The domains this load carries — the whole set when called with no argument. */\n  readonly domains: readonly string[];\n  /** Keyed by `operationId`. */\n  readonly operations: Readonly<Record<string, ProviderRestOperation>>;\n  /**\n   * Which package contributed an operation that the provider's OWN module does not declare, keyed by\n   * `operationId` (#1672). Absent on every catalogue a provider module loads itself; set only by the\n   * framework when it merges an opted-in AUGMENTATION into a provider it does not own.\n   *\n   * A catalogue value and not a property of the operation, on purpose: an operation declaration is the\n   * augmentation author's data, and a field the author could write would let a package claim to be\n   * somebody else. The merge refuses a loaded catalogue that already carries this field.\n   *\n   * Read by the operation executor, which writes the contributor into the `PROVIDER_OPERATION_CALL` audit\n   * row: a call spending a shared grant must say whose code declared the request it sent.\n   */\n  readonly augmentedBy?: Readonly<Record<string, ProviderRestOperationContributor>>;\n}\n\n/** The package that contributed an operation to a provider it does not own (#1672). */\nexport interface ProviderRestOperationContributor {\n  /** The augmentation package's npm name, as its own manifest states it. */\n  readonly packageName: string;\n  /** The installed version of that package, as `wildo config sync` read it from the manifest. */\n  readonly packageVersion: string;\n}\n/** @wildo_source:part:end external-connectors.models.rest-operation-contract */\n\n/**\n * The lazy catalogue loader — the seam #330's host loader consumes (interface note on #331).\n *\n * MUST NOT be called during composition, discovery or boot: it exists so a provider package can\n * `import()` its own operation module only when a run needs it, and calling it at boot puts every\n * provider's operations back into every process's boot graph, which is the thing on-demand\n * loading exists to remove. Async, idempotent, and memoized by the executor per\n * `(providerRef, domain)` — a loader may assume one call per pair and must stay correct on two.\n *\n * The values it returns carry live Zod schemas, so a catalogue is an IN-PROCESS value and is\n * never serializable into a runtime artifact or any JSON the CLI emits.\n */\nexport type ProviderRestOperationCatalogueLoader = (domain?: string) => Promise<ProviderRestOperationCatalogue>;\n\n/**\n * Provider-level call semantics: the defaults every operation of this provider runs under.\n *\n * Structurally the executable subset of the ETL's `HttpApiRemoteCallSemantics`, and deliberately\n * NOT that type: the ETL's lives in `@wildo-ai/saas-models/external-data` and carries\n * `maxIdSetSize`, an ETL query-translation bound that means nothing to a provider operation.\n * Importing it here would point the PROVIDER contract at the ETL read surface — backwards, since\n * the ETL references provider operations and not the reverse. Three fields is the price of\n * keeping that arrow pointing the right way.\n */\nexport interface ProviderRestCallSemantics {\n  /** Per-attempt timeout. */\n  readonly timeoutMs: number;\n  readonly retry: {\n    /** Total attempts including the first; 1 disables retry. */\n    readonly maxAttempts: number;\n    /** Linear backoff base — attempt N waits `backoffMs * (N - 1)`. */\n    readonly backoffMs: number;\n  };\n  /**\n   * This REF's share of its connection's allowance: a sliding-window ceiling counted for every call made\n   * through this ref, whichever account it spends (#1729).\n   *\n   * It is a CEILING UNDER the connection's own budgets ({@link ProviderRateBudgetDeclaration}, declared by\n   * the connection's base), never a statement of the vendor's limit: several refs of one shared connection\n   * each keep their own ceiling and all draw on the one vendor allowance together.\n   */\n  readonly maxRequestsPerMinute?: number;\n}\n\n/** @wildo_source:part:start external-connectors.models.connection-rate-budgets facet:layer:shared facet:family:provider facet:audience:app-developer */\n/**\n * WHOSE allowance a vendor counts a request against, under one connection (#1729).\n *\n * A connection is one application registration at the vendor (one OAuth client, one API project) — the\n * base provider's, however many refs spend it. Vendors meter on two axes of it, and a provider declares the\n * one each of its limits uses:\n *\n * | vendor wording | member |\n * |---|---|\n * | Microsoft Graph \"per app across all tenants\"; Google \"per minute per project\" | {@link CONNECTION} |\n * | Google \"per minute per user per project\"; Dataverse \"for each user\"; Graph \"per app per tenant\" / \"per app and mailbox\" when the grant owner IS that tenant or mailbox | {@link OWNER} |\n *\n * spec-cite: https://learn.microsoft.com/en-us/graph/throttling-limits — the global-limits table (\"Per app across all\n * tenants\") and the scope list \"per app across all tenants, per tenant for all apps, per app per tenant\"; and\n * https://developers.google.com/workspace/drive/api/guides/limits — \"per minute per project\" / \"per minute per user per\n * project\". Fetched 2026-09-28.\n *\n * Deliberately NOT a member: \"per tenant for all apps\" (Graph). It counts OTHER applications' calls, which this\n * deployment cannot see, so no local counter can hold it; the vendor's `429` is the only honest signal there.\n */\nexport enum ProviderRateBudgetPartition {\n  /** One allowance for the whole connection — every ref, every account it acts for, every process. */\n  CONNECTION = 'connection',\n  /** One allowance per account the connection acts for — the grant's owner (a person, an organization, the deployment). */\n  OWNER = 'owner',\n}\n\n/**\n * One limit a vendor publishes, as the connection's BASE provider declares it (#1729).\n *\n * Read only from the connection's base: a member ref's declaration is inert, exactly like a member's OAuth client,\n * because the limit belongs to the registration and the base owns the registration. Declared on the REST contract\n * (`rest.rateBudgets`) for a connection whose tokens serve one resource, and on each OAuth2 AUDIENCE\n * (`oauth2.audiences.<id>.rateBudgets`) for a connection spanning several — Microsoft Graph and a Dataverse\n * environment are metered by different services with different numbers, so one list for both would be wrong for one.\n *\n * Counted by the engine BEFORE a request leaves: a call waits for room (bounded, see the executor's\n * `rateBudgetWaitMs`) instead of spending a request the vendor would answer with `429`. The window is SLIDING, which\n * is at least as strict as a vendor's fixed window of the same length.\n */\nexport interface ProviderRateBudgetDeclaration {\n  /** How many requests the window admits. */\n  readonly maxRequests: number;\n  /** The window's length, in seconds, as the vendor states it (Graph's global limit is per 10 s, Dataverse's per 300 s). */\n  readonly windowSeconds: number;\n  /** Whose allowance it is — see {@link ProviderRateBudgetPartition}. */\n  readonly partition: ProviderRateBudgetPartition;\n}\n\n/**\n * Where a budget was COUNTED, as the call that spent it observed (#1729): `shared` when the deployment's shared store\n * (Redis) counted it for every process of the application — backend replicas, minions, workers — and `process` when\n * only this process did, because no shared store is configured here or it did not answer. Recorded on the call's audit\n * row, so a per-process count is visible rather than implied.\n */\nexport enum RateBudgetCounting {\n  SHARED = 'shared',\n  PROCESS = 'process',\n}\n\n/**\n * The defects of a connection's rate-budget declarations: a non-positive number, and a contract-level list beside\n * `oauth2.audiences` — which would apply to nothing, since every call of such a connection is on one audience. A pure\n * function so the registry refuses it at boot and a test pins it without a host.\n */\nexport function describeProviderRateBudgetDefects(input: {\n  readonly contractRateBudgets?: readonly ProviderRateBudgetDeclaration[];\n  readonly audiences?: Readonly<Record<string, { readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[] }>>;\n}): string[] {\n  const defects: string[] = [];\n  const check = (where: string, declarations: readonly ProviderRateBudgetDeclaration[] | undefined): void => {\n    for (const [index, declaration] of (declarations ?? []).entries()) {\n      if (!Number.isInteger(declaration.maxRequests) || declaration.maxRequests < 1) {\n        defects.push(`${where}[${index}].maxRequests must be a positive integer (got ${String(declaration.maxRequests)})`);\n      }\n      if (!Number.isFinite(declaration.windowSeconds) || declaration.windowSeconds <= 0) {\n        defects.push(`${where}[${index}].windowSeconds must be positive (got ${String(declaration.windowSeconds)})`);\n      }\n      if (!Object.values(ProviderRateBudgetPartition).includes(declaration.partition)) {\n        defects.push(`${where}[${index}].partition '${String(declaration.partition)}' is not a ProviderRateBudgetPartition`);\n      }\n    }\n  };\n  check('rest.rateBudgets', input.contractRateBudgets);\n  for (const [id, audience] of Object.entries(input.audiences ?? {})) check(`oauth2.audiences.${id}.rateBudgets`, audience.rateBudgets);\n  if ((input.contractRateBudgets?.length ?? 0) > 0 && Object.keys(input.audiences ?? {}).length > 0) {\n    defects.push('rest.rateBudgets is declared beside oauth2.audiences and would apply to no call — declare each limit on the audience it meters');\n  }\n  return defects;\n}\n\n/**\n * The declarations that apply to one call: the audience's own when the call's token is for an audience, else the\n * contract's. Nothing is inherited between the two — see {@link describeProviderRateBudgetDefects}.\n */\nexport function selectProviderRateBudgetDeclarations(input: {\n  readonly contractRateBudgets?: readonly ProviderRateBudgetDeclaration[];\n  readonly audience?: { readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[] };\n}): readonly ProviderRateBudgetDeclaration[] {\n  return input.audience !== undefined ? input.audience.rateBudgets ?? [] : input.contractRateBudgets ?? [];\n}\n/** @wildo_source:part:end external-connectors.models.connection-rate-budgets */\n\n\n/**\n * A provider whose credential is MINTED by an authorization-code exchange rather than pasted.\n *\n * Recorded because the source catalogues state it and nothing else does. 131 of the 699 transposed\n * vendors declare OAuth2, and their authorize URL, token URL and scopes exist nowhere in this\n * repository except the catalogue that was read — so extracting them and keeping them only in a\n * comment (which is what the transposer did until 2026-09-07) means the delegated-authorization lane\n * re-derives 131 vendors' endpoints by hand.\n *\n * ## What it does NOT change\n *\n * The wire placement. An OAuth2 access token rides in the same header as an API key —\n * `Authorization: Bearer …` — so `apiKey.headerName` and `apiKey.prefix` still describe the request,\n * and `apiKey.secretRef` still names the slot the credential is read from. What this block adds is\n * where that value COMES FROM: an exchange, per organization or per user, refreshable — rather than\n * an operator pasting a long-lived token into an environment variable.\n *\n * That distinction is the whole point. Without it a provider declares a static bearer key and, if an\n * operator happens to paste a long-lived token, WORKS — while advertising a credential model the\n * vendor does not offer, with no authorize step, no refresh and no per-tenant token. A wrong\n * configuration that works is worse than one that fails, because nothing surfaces it.\n *\n * The FLOW is not here and is not implied: connected accounts, the authorization round trip, refresh\n * and revocation are their own lane. This is the declaration that lane consumes.\n */\nexport interface ProviderRestOAuth2 {\n  /** Where the user is sent to grant access. Carries the vendor's own default scopes when it states them. */\n  readonly authorizeUrl: string;\n  /** Where an authorization code (or a refresh token) is exchanged for an access token. */\n  readonly tokenUrl: string;\n  /**\n   * Where a token is handed back to the vendor so the GRANT ends there too (#545).\n   *\n   * Deleting our copy of a token stops US using it. It does not stop the token working, and a\n   * refresh token frequently never expires on its own — so without this, \"Disconnect\" leaves the\n   * application listed in the person's own connected-apps screen at the vendor, and their belief\n   * that they have withdrawn access is not quite true.\n   *\n   * ## Why the field names RFC 7009 rather than \"revocation\"\n   *\n   * The name is the CONTRACT, not decoration. A URL here is POSTed\n   * `application/x-www-form-urlencoded` with a `token` parameter and an optional\n   * `token_type_hint`, and a 200 means the grant is gone — including for a token the server does\n   * not recognise.\n   * spec-cite: RFC 7009 §2.1 (revocation request) and §2.2 (revocation response), fetched\n   * 2026-09-18 — §2.2: *\"The authorization server responds with HTTP status code 200 if the token\n   * has been revoked successfully or if the client submitted an invalid token\"*, and *\"invalid\n   * tokens do not cause an error response since the client cannot handle such an error in a\n   * reasonable way.\"*\n   *\n   * That last sentence is why the caller is best-effort and never branches on the body: there is\n   * nothing to branch on.\n   *\n   * **A vendor whose revocation is NOT RFC 7009 declares nothing here, deliberately.** Slack's\n   * `auth.revoke` is a Web API method and GitHub's is `DELETE /applications/{client_id}/token` with\n   * basic auth and a JSON body; neither is expressible as this URL, and bending the field to fit\n   * them would make a declaration that names RFC 7009 and means something else entirely. Those vendors\n   * need a per-vendor revocation ACTION, which is a bigger surface and is not built on speculation —\n   * until then the honest answer is an absent field, and the disconnect surface says so.\n   *\n   * Absent — not empty — when no revocation is declared, so \"this vendor cannot be told\" stays\n   * distinguishable from \"nobody has looked\".\n   */\n  readonly rfc7009RevocationUrl?: string;\n  /**\n   * Scopes the vendor's own catalogue entry asked for. An application may request FEWER (a subset of\n   * these, once resolved), and an operation's `requiredScopes` is the finer statement. Kept because\n   * it is the only record of what the vendor expects for the operations transposed beside it.\n   *\n   * ## A scope may carry a placeholder, and it is resolved like an endpoint's (#991)\n   *\n   * Two shapes exist, classified by {@link classifyProviderOAuth2ScopePlaceholder}:\n   *\n   * - `{hostUrl}/.default` — the placeholder BEGINS the scope and is followed by `/`, so its value is\n   *   an ORIGIN (Microsoft Dataverse names the resource a token is minted FOR by the environment URL).\n   *   It is filled only within {@link endpointHostAllowances}, exactly like an origin in an endpoint:\n   *   a caller-chosen resource would have the vendor mint a token for a host nobody declared.\n   * - `{permissions}` — the placeholder IS the whole scope entry, and its value is one or more scope\n   *   tokens chosen from {@link scopeValueAllowances}. Such a value can itself name a resource\n   *   (`https://graph.microsoft.com/.default`), so it is a closed choice, never free text.\n   *\n   * Any other placement (`api://{x}`, `{a}{b}`, `{x}.default`) is refused as malformed.\n   */\n  readonly scopes?: readonly string[];\n  /**\n   * How this vendor lets an EXISTING grant grow by one permission (#1671) — declared by the provider module that\n   * owns the OAuth client, never guessed by the engine. See {@link ProviderOAuth2IncrementalConsent}.\n   *\n   * Absent means the vendor's behaviour is not recorded, so a re-authorization for a missing scope RESTATES what the\n   * grant already holds beside the addition: an ordinary authorization that replaces the previous one, which every\n   * RFC 6749 server honours. Declared, the re-authorization asks for the missing scope only and the stored granted\n   * set ACCUMULATES the previous consent with the new answer.\n   */\n  readonly incrementalConsent?: ProviderOAuth2IncrementalConsent;\n  /**\n   * Scopes a person cannot grant for themselves: only an administrator of the account can (#1671). Microsoft's\n   * application permissions and its admin-restricted delegated permissions are the case — \"Application permissions\n   * always require admin consent\", and a delegated permission that requires admin consent answers a user with \"an\n   * 'unauthorized to consent' error\".\n   * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — \"Admin Consent for\n   * Application permissions\" and \"Admin Consent for Delegated Permissions\", fetched 2026-09-27.\n   *\n   * Never put in a re-authorization request a person is sent to: an operation needing one is refused with the\n   * statement that an administrator must grant it, which is the only thing the person can act on.\n   */\n  readonly administratorConsentScopes?: readonly string[];\n  /**\n   * Env-var names resolving the APPLICATION's registration with the vendor. These are the two values\n   * an operator genuinely does paste — they identify the integration, not the end user — and they\n   * are separate from `apiKey.secretRef`, which names the minted access token.\n   */\n  readonly clientIdSecretRef?: string;\n  readonly clientSecretSecretRef?: string;\n  /**\n   * Placeholders the endpoints above carry, which a CONNECTION must answer before either URL is a\n   * URL at all — `{cloud}`, `{tenantId}`, `{region}`, `{domain}`. A PATH placeholder is answered freely;\n   * a HOST or ORIGIN one only from {@link ProviderRestOAuth2.endpointHostAllowances}.\n   *\n   * Re-measured over the generated catalogue on 2026-09-12: of the 99 vendors that recovered both\n   * endpoints, **20 carry at least one placeholder**, led by `{cloud}` (18 occurrences), `{location}`\n   * (10) and `{tenantId}` (6). Microsoft's authorize URL is\n   * `https://{cloud}/{tenantId}/oauth2/v2.0/authorize`, and no amount of application configuration\n   * supplies those: which Azure cloud and which directory are facts about the ACCOUNT BEING\n   * CONNECTED, known only to the person connecting it.\n   *\n   * So this is not decoration on the endpoint strings — it is the difference between a vendor that\n   * can be connected and one that cannot. Without it the flow would build\n   * `https://{cloud}/…/authorize`, send somebody to a hostname containing a brace, and fail in the\n   * browser rather than at the point where the missing input could have been asked for.\n   *\n   * DERIVED from the endpoint strings rather than authored, so a vendor whose URL gains a\n   * placeholder declares one the next time the batch runs. Absent — not empty — when the endpoints\n   * are plain, which is the common case and must stay distinguishable from \"nobody has looked\".\n   *\n   * Deliberately NOT a judgement about which connections a provider admits. That is a recorded\n   * decision in the catalogue record and is never read from a vendor's API surface; this is a\n   * mechanical fact about a string.\n   *\n   * A placeholder filled from {@link ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_BASE_URL} or\n   * {@link ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_CONFIGURED} is NOT listed: nobody\n   * connecting an account is asked for it, and a value they supply is refused.\n   *\n   * Derived from the {@link scopes} as well as the endpoints (#991): Dataverse's `{hostUrl}/.default`\n   * names a fact about the account (its environment URL) that no endpoint carries, and a placeholder\n   * only a scope mentions was otherwise never asked for — so the authorize request carried the literal\n   * brace to the vendor.\n   */\n  readonly connectionParameters?: readonly string[];\n  /**\n   * How each placeholder that forms an endpoint's HOST or ORIGIN may be filled, keyed by\n   * placeholder name. A host/origin placeholder with NO entry here cannot be filled at all, and the\n   * connect flow refuses it.\n   *\n   * ## Why this exists: the token endpoint receives the application's client secret\n   *\n   * The exchange POSTs `client_id` and the APPLICATION's `client_secret` to the resolved `tokenUrl`.\n   * Until 2026-09-12 every placeholder was answered from the connect-start request body, so where a\n   * placeholder formed the HOST — Microsoft's `https://{cloud}/…/token`, Salesforce's\n   * `https://{environment}/…`, Zoho's `https://accounts.{location}/…` — any user allowed to start a\n   * connection chose where that secret was sent (`cloud=attacker.tld`). Measured over the generated\n   * catalogue that day: 34 host-position occurrences across 17 vendors (9 Microsoft, 6 Zoho,\n   * Salesforce, Workday), plus two whole-origin\n   * placeholders (`gitea`, `bigin-by-zoho`) that were safe only because percent-encoding made them\n   * undialable (#623).\n   *\n   * So a host/origin value is chosen from what the PROVIDER declares, never from what a caller\n   * types. Path and query placeholders (`{tenantId}`, Workday's `{tenant}`) stay free and are\n   * percent-encoded, because an encoded path segment cannot move the request to another host.\n   *\n   * Derived by the transposer where the source catalogue states a closed choice (a dropdown), and\n   * otherwise taken from a recorded human decision in the catalogue record — never guessed.\n   *\n   * Also governs a placeholder that forms the ORIGIN of a SCOPE (`{hostUrl}/.default`, #991). One\n   * allow-list per placeholder name, wherever the name forms a host: a scope's resource URI decides\n   * which host the vendor mints the token for, which is the same question an endpoint's host answers.\n   */\n  readonly endpointHostAllowances?: Readonly<Record<string, ProviderOAuth2EndpointHostAllowance>>;\n  /**\n   * The closed set of values a WHOLE-SCOPE placeholder (`scopes: ['{permissions}']`) may be answered\n   * with, keyed by placeholder name (#991).\n   *\n   * Each value is substituted verbatim as that scope entry and may hold several space-delimited scope\n   * tokens — Microsoft Entra ID's permission presets are one such string each. Matched exactly, because\n   * scope values are case-sensitive.\n   * spec-cite: RFC 6749 §3.3 (the scope parameter is a list of space-delimited, case-sensitive strings).\n   *\n   * Closed rather than free because a scope value can itself name a resource\n   * (`https://graph.microsoft.com/.default`), and a whole-scope placeholder with NO entry here cannot be\n   * answered at all. Derived by the transposer from the source's own dropdown; never guessed.\n   */\n  readonly scopeValueAllowances?: Readonly<Record<string, ProviderOAuth2ScopeValueAllowance>>;\n  /**\n   * Dot-path, inside the TOKEN ENDPOINT'S JSON answer, to the vendor's own identifier for the account\n   * that was just authorized — Slack's `team.id` (#333).\n   *\n   * Read once, at the exchange, into the stored grant's `accountRef`, so a person holding two\n   * connections to one vendor can tell which is which and the grant audit names the account. Absent\n   * means the vendor reports no account identity in its token answer (Asana's names only the user).\n   *\n   * Identity only: nothing looks a credential up by it, and an answer that lacks the path stores the\n   * grant without it — a missing label is not a reason to discard an authorization the person just gave.\n   */\n  readonly accountRefResponsePath?: string;\n  /**\n   * Facts about the connected ACCOUNT that the vendor reports in its token answer and OPERATIONS consume,\n   * keyed by the fact's name (#333, #1047) — Salesforce's `instance_url`, Pipedrive's `api_domain`.\n   *\n   * Captured at the authorization-code exchange and again at every refresh, into the credential row's\n   * `connectionFacts` with provenance `REPORTED_BY_VENDOR`. Distinct from {@link accountRefResponsePath}:\n   * that is a LABEL a person reads, sealed in the grant; these are values requests are built from, kept\n   * client-readable beside the answers a person typed at connect.\n   *\n   * A fact that carries an `origin` allowance is an https ORIGIN operations may dial, so it decides where a\n   * request carrying the credential goes. It is therefore admitted exactly as an ORIGIN placeholder is\n   * ({@link endpointHostAllowances}): refused at connect when absent or outside the allowance, and\n   * re-checked on every call that uses it.\n   */\n  readonly reportedAccountFacts?: Readonly<Record<string, ProviderOAuth2ReportedAccountFact>>;\n  /**\n   * The RESOURCE AUDIENCES one grant of this client can mint tokens for, keyed by audience id (#1725), and the\n   * HOSTS a token of each may be sent to.\n   *\n   * ## Why a grant needs more than one access token\n   *\n   * Microsoft issues an access token for ONE resource per request: the token redemption's scopes \"must all be from a\n   * single resource\", and a refresh request spanning several resources returns \"a token for the resource specified\n   * in the first scope\". A refresh token, though, is not tied to a resource: \"A client can use a refresh token to\n   * acquire access tokens across any combination of resource and tenant where it has permission to do so.\" So a\n   * connection spanning Graph and Dataverse keeps ONE refresh token and mints a token per audience from it.\n   * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow — the `scope` rows\n   * of \"Redeem a code for an access token\" and \"Refresh the access token\"; and\n   * https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens — the opening section. Fetched 2026-09-27.\n   *\n   * ## Why the HOSTS are part of the declaration\n   *\n   * An access token is a bearer credential for its resource. Declaring which hosts receive a token of each audience is\n   * what lets the engine attach a token only to a request bound for its own resource (the token-host binding), so an\n   * operation — the base's own, a member's, or an augmentation's (#1672) — can never carry a Graph token to another\n   * host.\n   *\n   * Absent means the provider mints one token for one resource, which is every provider except a connection base that\n   * spans several. When present, {@link primaryAudience} names the audience the AUTHORIZATION grants — the resource of\n   * the connect request's scopes — whose token is the one stored with the grant; every other audience's token is minted\n   * from the refresh token on demand and cached, never stored.\n   */\n  readonly audiences?: Readonly<Record<string, ProviderRestOAuth2Audience>>;\n  /** The audience the authorization itself grants — see {@link audiences}. Required when `audiences` is declared. */\n  readonly primaryAudience?: string;\n}\n\n/** @wildo_source:part:start external-connectors.models.oauth2-audiences facet:layer:shared facet:family:provider facet:audience:app-developer */\n/** The placeholder a {@link ProviderRestOAuth2Audience.mintScopes} entry uses for the https origin of the request's host. */\nexport const PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER = '{audienceOrigin}';\n\n/** One resource audience of a connection's grant. See {@link ProviderRestOAuth2.audiences}. */\nexport interface ProviderRestOAuth2Audience {\n  /**\n   * The hosts a token of this audience may be sent to: exact lower-case hosts, and dotted suffixes admitting\n   * `<dns-labels><suffix>` (never the bare suffix). Every host is https.\n   */\n  readonly hosts: {\n    readonly values: readonly string[];\n    readonly hostSuffixes?: readonly string[];\n  };\n  /**\n   * The scopes that mint a token for this audience, all of ONE resource. An entry may begin with\n   * {@link PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER} — the https origin of the request's own host, admitted by\n   * {@link hosts} first — for a resource named per customer (a Dataverse environment's `<environment-url>/.default`).\n   */\n  readonly mintScopes: readonly string[];\n  /**\n   * The vendor's published limits for THIS resource (#1729) — see {@link ProviderRateBudgetDeclaration}. Per audience\n   * because each resource is metered by its own service: Graph's limits say nothing about a Dataverse environment.\n   */\n  readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[];\n}\n\n/** The audience a request host belongs to, with its id — see {@link selectProviderOAuth2AudienceForHost}. */\nexport interface ProviderOAuth2AudienceSelection {\n  readonly id: string;\n  readonly audience: ProviderRestOAuth2Audience;\n  readonly primary: boolean;\n}\n\n/** Whether `host` is admitted by one audience's hosts: an exact value, or `<labels><suffix>` for a declared suffix. */\nexport function providerOAuth2AudienceAdmitsHost(audience: ProviderRestOAuth2Audience, host: string): boolean {\n  const candidate = host.toLowerCase();\n  if (audience.hosts.values.some((value) => value.toLowerCase() === candidate)) return true;\n  return (audience.hosts.hostSuffixes ?? []).some((suffix) => {\n    const lowered = suffix.toLowerCase();\n    if (!candidate.endsWith(lowered) || candidate.length === lowered.length) return false;\n    return PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(candidate.slice(0, candidate.length - lowered.length));\n  });\n}\n\n/**\n * The ONE audience whose hosts admit `host`, or `undefined` when none does. The declaration guarantees at most one\n * ({@link describeProviderOAuth2AudienceDefects} refuses overlapping hosts), so the answer never depends on order.\n */\nexport function selectProviderOAuth2AudienceForHost(\n  oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience'>,\n  host: string,\n): ProviderOAuth2AudienceSelection | undefined {\n  for (const [id, audience] of Object.entries(oauth2.audiences ?? {})) {\n    if (providerOAuth2AudienceAdmitsHost(audience, host)) return { id, audience, primary: id === oauth2.primaryAudience };\n  }\n  return undefined;\n}\n\n/**\n * The scopes that mint `audience`'s token for a request to `origin` — `{audienceOrigin}` replaced by that origin.\n * The caller has already admitted the origin's host through {@link selectProviderOAuth2AudienceForHost}; nothing a\n * caller supplies reaches a scope any other way.\n */\nexport function resolveProviderOAuth2AudienceMintScopes(audience: ProviderRestOAuth2Audience, origin: string): readonly string[] {\n  return audience.mintScopes.map((scope) => (scope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER)\n    ? `${origin}${scope.slice(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER.length)}`\n    : scope));\n}\n\n/**\n * The declared audience a scope a connection might REQUEST names (#1671): its id, or `undefined` when the scope names a\n * resource none of the connection's audiences covers. Only meaningful when `audiences` is declared.\n *\n * A scope that is an absolute URI names the resource a token is minted for (`https://graph.microsoft.com/Mail.Send`,\n * `https://contoso.crm.dynamics.com/user_impersonation`): the resource of one of an audience's fixed mint scopes (the\n * mint scope without its last path segment), or — for a mint scope beginning `{audienceOrigin}` — an https origin whose\n * host the audience admits. A scope that is not an absolute URI (`offline_access`, `Files.Read`) names no resource, and\n * the vendor reads it against its default one, the PRIMARY audience: \"omitting the resource identifier in the `scope`\n * parameter defaults to Microsoft Graph\".\n * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — the note under\n * \"Admin Consent for Delegated Permissions\", fetched 2026-09-27.\n */\nexport function findProviderOAuth2ScopeAudience(\n  oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience'>,\n  scope: string,\n): string | undefined {\n  const audiences = oauth2.audiences ?? {};\n  if (!/^[a-z][a-z0-9+.-]*:\\/\\//i.test(scope)) return oauth2.primaryAudience;\n  // The https origin's host, read by the same shape the audiences declare (a DNS name, no port, no credentials) rather\n  // than by a URL parser: this package runs in a browser-neutral program with no URL global, and a scope that is not\n  // that shape names no host an audience could admit.\n  const origin = /^https:\\/\\/([^/?#:@]+)(?:\\/|$)/i.exec(scope);\n  const host = origin?.[1]?.toLowerCase();\n  for (const [id, audience] of Object.entries(audiences)) {\n    for (const mintScope of audience.mintScopes) {\n      if (mintScope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER)) {\n        if (host !== undefined && PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(host) && providerOAuth2AudienceAdmitsHost(audience, host)) return id;\n        continue;\n      }\n      const resource = mintScope.slice(0, mintScope.lastIndexOf('/'));\n      if (resource.length > 0 && scope.startsWith(`${resource}/`)) return id;\n    }\n  }\n  return undefined;\n}\n\n/**\n * Whether a scope a connection might REQUEST names a resource among the connection's declared audiences (#1671) — see\n * {@link findProviderOAuth2ScopeAudience}. Asking a person to consent to it is asking them to let this application reach\n * THAT resource, so a scope from a member ref or an opted-in augmentation (#1672) is requestable only when it names one\n * the connection declares. `true` without looking further when the connection declares no audiences: it mints one token\n * for one resource and its scopes are the vendor's own vocabulary (Google's scope URIs name permissions, not resources).\n */\nexport function providerOAuth2ScopeNamesDeclaredAudience(\n  oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience'>,\n  scope: string,\n): boolean {\n  if (oauth2.audiences === undefined) return true;\n  if (!/^[a-z][a-z0-9+.-]*:\\/\\//i.test(scope)) return true;\n  return findProviderOAuth2ScopeAudience(oauth2, scope) !== undefined;\n}\n/** @wildo_source:part:end external-connectors.models.oauth2-audiences */\n\n/** @wildo_source:part:start external-connectors.models.oauth2-incremental-consent facet:layer:shared facet:family:provider facet:audience:app-developer */\n/**\n * How a vendor extends an existing delegated grant with more scopes — see {@link ProviderRestOAuth2.incrementalConsent}.\n */\nexport enum ProviderOAuth2IncrementalConsentForm {\n  /**\n   * The vendor keeps what the person already consented to, and a new authorization request naming only the added\n   * scopes ADDS them: Microsoft's delegated permissions \"will be granted in addition to any other permissions that\n   * were already granted for that app (i.e. incremental)\".\n   * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — \"Incremental and\n   * dynamic user consent\", fetched 2026-09-27.\n   */\n  ADDITIVE = 'ADDITIVE',\n  /**\n   * The vendor adds the new scopes to the existing grant only when the request carries `include_granted_scopes=true`:\n   * \"If you set this parameter's value to `true` and the authorization request is granted, then the new access token\n   * will also cover any scopes to which the user previously granted the application access.\"\n   * spec-cite: https://developers.google.com/identity/protocols/oauth2/web-server#incrementalAuth — the\n   * `include_granted_scopes` parameter row, fetched 2026-09-27.\n   */\n  INCLUDE_GRANTED_SCOPES = 'INCLUDE_GRANTED_SCOPES',\n}\n\n/** A vendor's incremental-consent behaviour. See {@link ProviderRestOAuth2.incrementalConsent}. */\nexport interface ProviderOAuth2IncrementalConsent {\n  readonly form: ProviderOAuth2IncrementalConsentForm;\n  /**\n   * Scopes every re-authorization request repeats beside the added ones — protocol scopes the answer needs rather than\n   * permissions (Microsoft's `offline_access`, without which a code redemption returns no refresh token). Each must be\n   * among the provider's declared {@link ProviderRestOAuth2.scopes}.\n   */\n  readonly restatedScopes?: readonly string[];\n}\n/** @wildo_source:part:end external-connectors.models.oauth2-incremental-consent */\n\n/**\n * Why a declared audience set cannot be honoured, or an empty list. Checked where a provider is composed, so a\n * malformed declaration never reaches a request:\n * - `primaryAudience` names no declared audience, or is missing while audiences are declared;\n * - the primary audience's mint scopes are not among the authorization's own `scopes` (its token is the one the\n *   code redemption returns, so the authorization must be FOR that resource) or use the origin placeholder;\n * - an audience with no host or no mint scope, a suffix without a leading dot, an origin placeholder anywhere but\n *   the start of a scope, or any other `{placeholder}` in a mint scope;\n * - two audiences admitting one host — a request host must select exactly one token.\n */\nexport function describeProviderOAuth2AudienceDefects(oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience' | 'scopes'>): string[] {\n  const audiences = oauth2.audiences;\n  if (audiences === undefined) {\n    return oauth2.primaryAudience === undefined ? [] : [`primaryAudience '${oauth2.primaryAudience}' is declared with no audiences`];\n  }\n  const defects: string[] = [];\n  const primary = oauth2.primaryAudience === undefined ? undefined : audiences[oauth2.primaryAudience];\n  if (primary === undefined) defects.push(`primaryAudience '${String(oauth2.primaryAudience)}' names no declared audience`);\n  for (const [id, audience] of Object.entries(audiences)) {\n    if (audience.hosts.values.length === 0 && (audience.hosts.hostSuffixes ?? []).length === 0) defects.push(`audience '${id}' admits no host`);\n    for (const suffix of audience.hosts.hostSuffixes ?? []) {\n      if (!suffix.startsWith('.') || !PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(suffix.slice(1).toLowerCase())) defects.push(`audience '${id}' declares the host suffix '${suffix}', which is not '.<dns-name>'`);\n    }\n    for (const value of audience.hosts.values) {\n      if (!PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(value.toLowerCase())) defects.push(`audience '${id}' declares the host '${value}', which is not a DNS name`);\n    }\n    if (audience.mintScopes.length === 0) defects.push(`audience '${id}' declares no mint scope`);\n    for (const scope of audience.mintScopes) {\n      const rest = scope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER) ? scope.slice(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER.length) : scope;\n      if (rest.includes('{') || rest.includes('}')) defects.push(`audience '${id}' mint scope '${scope}' carries a placeholder other than a leading ${PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER}`);\n    }\n  }\n  if (primary !== undefined) {\n    for (const scope of primary.mintScopes) {\n      if (scope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER)) defects.push(`the primary audience '${oauth2.primaryAudience}' mint scope '${scope}' names a per-request origin; the authorization must be for one fixed resource`);\n      else if (!(oauth2.scopes ?? []).includes(scope)) defects.push(`the primary audience '${oauth2.primaryAudience}' mint scope '${scope}' is not among the authorization's own scopes`);\n    }\n  }\n  const entries = Object.entries(audiences);\n  for (let left = 0; left < entries.length; left += 1) {\n    for (let right = left + 1; right < entries.length; right += 1) {\n      const [leftId, leftAudience] = entries[left]!;\n      const [rightId, rightAudience] = entries[right]!;\n      const overlap = leftAudience.hosts.values.some((host) => providerOAuth2AudienceAdmitsHost(rightAudience, host))\n        || rightAudience.hosts.values.some((host) => providerOAuth2AudienceAdmitsHost(leftAudience, host))\n        || (leftAudience.hosts.hostSuffixes ?? []).some((suffix) => (rightAudience.hosts.hostSuffixes ?? []).some((other) => suffix.toLowerCase().endsWith(other.toLowerCase()) || other.toLowerCase().endsWith(suffix.toLowerCase())));\n      if (overlap) defects.push(`audiences '${leftId}' and '${rightId}' admit a common host; a request host must select one token`);\n    }\n  }\n  return defects;\n}\n\n/** One vendor-reported account fact. See {@link ProviderRestOAuth2.reportedAccountFacts}. */\nexport interface ProviderOAuth2ReportedAccountFact {\n  /** Dot-path inside the token endpoint's JSON answer. A string or finite number there is the value. */\n  readonly responsePath: string;\n  /**\n   * Present when the value is an https ORIGIN operations dial. The same DECLARED_VALUES vocabulary an\n   * ORIGIN placeholder uses: exact origins, or `https://<dns-labels><suffix>` for each dotted suffix.\n   */\n  readonly origin?: Extract<ProviderOAuth2EndpointHostAllowance, { readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DECLARED_VALUES }>;\n}\n\n/** The values a whole-scope placeholder admits. See {@link ProviderRestOAuth2.scopeValueAllowances}. */\nexport interface ProviderOAuth2ScopeValueAllowance {\n  readonly values: readonly string[];\n  /** Values the vendor's source offers and the catalogue declines, matched exactly. See {@link ProviderOAuth2UnsupportedValues}. */\n  readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;\n}\n\n/**\n * Values the vendor's OWN source offers for a placeholder and this catalogue deliberately does NOT admit, each mapped\n * to the reason (#1937). Keyed by the value as the source writes it.\n *\n * Not a second allow-list: the admitted set (`values`, `hosts`) alone decides what is admitted, and a value found\n * here is refused exactly as any other unadmitted value is (`VALUE_NOT_ADMITTED`, which also retires a STORED\n * connection that carries it). What this adds is the WHY. A person who chose, or a connection that stored, a value\n * the catalogue declined is told that it is unsupported and for what reason, instead of being handed a list of other\n * values as though they had made a typing mistake.\n *\n * The first entry is the US Government Microsoft clouds (`login.microsoftonline.us`, GCC High and DoD), declared out\n * of scope by product decision on 2026-09-29. The transposer writes these from the vendor record's declared\n * exclusion (`_code_archive/providers/catalogue-record/vendors/<vendor>.json` since #2019 archived the catalogue; a\n * registry provider adopted from it states them in its own module under `providers-registry/<ref>/`), so reversing a\n * decision is record edits and a regeneration, never an engine change. How many edits depends on what the decline also removed: for the US\n * Government clouds, three (the catalogue README lists them).\n */\nexport type ProviderOAuth2UnsupportedValues = Readonly<Record<string, string>>;\n\n/** How a placeholder's value is compared with a declared one. */\nexport enum ProviderOAuth2ValueComparison {\n  /** A host or an origin: DNS names compare case-insensitively. spec-cite: RFC 4343 §2. */\n  CASE_INSENSITIVE = 'CASE_INSENSITIVE',\n  /** A scope value: scope strings are case-sensitive. spec-cite: RFC 6749 §3.3. */\n  EXACT = 'EXACT',\n}\n\n/**\n * The declared reason a value is unsupported, or `undefined` when it is not declared unsupported. Compared as the\n * placeholder's values are: case-insensitively for a host or origin, exactly for a scope value.\n */\nexport function findProviderOAuth2UnsupportedValueReason(\n  unsupportedValues: ProviderOAuth2UnsupportedValues | undefined,\n  value: string,\n  comparison: ProviderOAuth2ValueComparison,\n): string | undefined {\n  if (unsupportedValues === undefined) return undefined;\n  const key = comparison === ProviderOAuth2ValueComparison.EXACT\n    ? (Object.hasOwn(unsupportedValues, value) ? value : undefined)\n    : Object.keys(unsupportedValues).find((candidate) => candidate.toLowerCase() === value.toLowerCase());\n  return key === undefined ? undefined : unsupportedValues[key];\n}\n\n/**\n * Why a declared unsupported-value map contradicts the admitted set it sits beside, or an empty list: a value both\n * admitted and declined would make the refusal reason a lie, and a declined value with no reason says nothing.\n */\nfunction describeProviderOAuth2UnsupportedValueDefects(\n  unsupportedValues: ProviderOAuth2UnsupportedValues | undefined,\n  admitted: readonly string[],\n  comparison: ProviderOAuth2ValueComparison,\n): readonly string[] {\n  if (unsupportedValues === undefined) return [];\n  const defects: string[] = [];\n  const normalise = (value: string): string => (comparison === ProviderOAuth2ValueComparison.EXACT ? value : value.toLowerCase());\n  const admittedSet = new Set(admitted.map(normalise));\n  for (const [value, reason] of Object.entries(unsupportedValues)) {\n    if (admittedSet.has(normalise(value))) defects.push(`'${value}' is both admitted and declared unsupported`);\n    if (typeof reason !== 'string' || reason.trim() === '') defects.push(`unsupported value '${value}' states no reason`);\n  }\n  return defects;\n}\n\n/**\n * Where a `{placeholder}` sits inside one OAuth2 SCOPE entry. See {@link classifyProviderOAuth2ScopePlaceholder}.\n *\n * Deliberately not {@link ProviderOAuth2EndpointPlaceholderPosition}: a scope is not a URL, and the\n * endpoint scan would call `{permissions}` an ORIGIN (it begins the string and nothing follows it).\n */\nexport enum ProviderOAuth2ScopePlaceholderPosition {\n  /**\n   * The placeholder begins the scope and is followed by `/` — `{hostUrl}/.default`. Its value is an\n   * https ORIGIN, admitted only within {@link ProviderRestOAuth2.endpointHostAllowances}.\n   */\n  ORIGIN = 'ORIGIN',\n  /**\n   * The placeholder is the entire scope entry — `{permissions}`. Its value is one of\n   * {@link ProviderRestOAuth2.scopeValueAllowances}.\n   */\n  WHOLE_SCOPE = 'WHOLE_SCOPE',\n}\n\n/** Why a scope entry cannot be resolved safely, whatever is supplied. See {@link findProviderOAuth2ScopeTemplateDefects}. */\nexport enum ProviderOAuth2ScopeTemplateDefect {\n  /**\n   * A placeholder sits anywhere except at the start of the scope followed by `/` or the end —\n   * `api://{x}/.default`, `{x}.default`, `openid {x}`. Such a value would be concatenated with text\n   * around it into a resource or scope nobody declared.\n   */\n  UNSUPPORTED_PLACEHOLDER_POSITION = 'UNSUPPORTED_PLACEHOLDER_POSITION',\n  /** More than one placeholder in one scope entry: each value validated alone can compose an undeclared one. */\n  SEVERAL_PLACEHOLDERS = 'SEVERAL_PLACEHOLDERS',\n  /** A `{` or `}` that is not part of a well-formed placeholder: a vendor can never grant a scope carrying one. */\n  STRAY_BRACE = 'STRAY_BRACE',\n}\n\n/** One `{placeholder}` in a scope entry. */\nexport interface ProviderOAuth2ScopePlaceholderOccurrence {\n  readonly name: string;\n  readonly position: ProviderOAuth2ScopePlaceholderPosition;\n  /** The whole `{name}` token, for substitution. */\n  readonly token: string;\n}\n\n/**\n * The defects that make a scope entry unsafe to resolve, or an empty list. Shared by the runtime (which\n * refuses) and the transposer (which refuses to emit), so neither admits a shape the other rejects.\n */\nexport function findProviderOAuth2ScopeTemplateDefects(scope: string): readonly ProviderOAuth2ScopeTemplateDefect[] {\n  const occurrences = [...scope.matchAll(PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN)];\n  const withoutPlaceholders = scope.replace(PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN, '');\n  const defects: ProviderOAuth2ScopeTemplateDefect[] = [];\n  if (withoutPlaceholders.includes('{') || withoutPlaceholders.includes('}')) defects.push(ProviderOAuth2ScopeTemplateDefect.STRAY_BRACE);\n  if (occurrences.length > 1) defects.push(ProviderOAuth2ScopeTemplateDefect.SEVERAL_PLACEHOLDERS);\n  const first = occurrences[0];\n  if (first !== undefined) {\n    const next = scope.charAt((first.index ?? 0) + first[0].length);\n    if ((first.index ?? 0) !== 0 || (next !== '' && next !== '/')) defects.push(ProviderOAuth2ScopeTemplateDefect.UNSUPPORTED_PLACEHOLDER_POSITION);\n  }\n  return defects;\n}\n\n/**\n * Classify the one placeholder a scope entry may carry, or `undefined` when it carries none.\n *\n * ONE function, shared by the transposer and the runtime, like its endpoint counterpart. Meaningful only\n * for a scope with no {@link findProviderOAuth2ScopeTemplateDefects}; every consumer refuses those first.\n */\nexport function classifyProviderOAuth2ScopePlaceholder(scope: string): ProviderOAuth2ScopePlaceholderOccurrence | undefined {\n  const match = /^\\{([A-Za-z_][A-Za-z0-9_]*)\\}/.exec(scope);\n  if (match === null) return undefined;\n  return {\n    name: match[1]!,\n    position: match[0].length === scope.length ? ProviderOAuth2ScopePlaceholderPosition.WHOLE_SCOPE : ProviderOAuth2ScopePlaceholderPosition.ORIGIN,\n    token: match[0],\n  };\n}\n\n/**\n * One scope token: printable ASCII except space, `\"` and backslash.\n * spec-cite: RFC 6749 §3.3 (scope-token = 1*( %x21 / %x23-5B / %x5D-7E )).\n * Braces are additionally refused: a value carrying one would read as a placeholder nobody resolves.\n */\nconst PROVIDER_OAUTH2_SCOPE_TOKEN_PATTERN = /^[\\x21\\x23-\\x5B\\x5D-\\x7A\\x7C\\x7E]+$/;\n\n/**\n * Why a declared whole-scope allowance cannot be applied, or an empty list. Enforced at generation so a\n * broken set refuses the batch; the runtime matches exactly and never trusts a value it did not declare.\n */\nexport function describeProviderOAuth2ScopeValueAllowanceDefects(allowance: ProviderOAuth2ScopeValueAllowance): readonly string[] {\n  const defects: string[] = [];\n  if (!Array.isArray(allowance.values) || allowance.values.length === 0) return ['a scope value allowance admits nothing'];\n  for (const value of allowance.values) {\n    const tokens = typeof value === 'string' ? value.split(' ') : [];\n    if (typeof value !== 'string' || value.length === 0 || !tokens.every((token) => PROVIDER_OAUTH2_SCOPE_TOKEN_PATTERN.test(token))) {\n      defects.push(`'${String(value)}' is not a space-delimited list of scope tokens`);\n    }\n  }\n  defects.push(...describeProviderOAuth2UnsupportedValueDefects(allowance.unsupportedValues, allowance.values, ProviderOAuth2ValueComparison.EXACT));\n  return defects;\n}\n\n/**\n * Where a `{placeholder}` sits inside an OAuth2 endpoint template — the classification the host\n * allow-list keys on. See {@link classifyProviderOAuth2EndpointPlaceholders}.\n */\nexport enum ProviderOAuth2EndpointPlaceholderPosition {\n  /**\n   * The placeholder BEGINS the template, so its value is the whole scheme + authority (+ any path\n   * prefix): `{baseUrl}/login/oauth/authorize`. The most dangerous position — the value names the\n   * scheme as well as the host.\n   */\n  ORIGIN = 'ORIGIN',\n  /**\n   * The placeholder sits between `://` and the first `/`, `?` or `#` after it:\n   * `https://{cloud}/common/…`, `https://accounts.{location}/…`. Its value decides which host\n   * receives the request.\n   */\n  HOST = 'HOST',\n  /** Anywhere after the authority. Percent-encoded, so it cannot move the request to another host. */\n  PATH_OR_QUERY = 'PATH_OR_QUERY',\n}\n\n/** How a host- or origin-forming placeholder may be filled. See {@link ProviderRestOAuth2.endpointHostAllowances}. */\nexport enum ProviderOAuth2EndpointHostAllowanceKind {\n  /**\n   * Chosen at connect time from values the provider DECLARES — Microsoft's commercial login cloud,\n   * Zoho's data centres. A value outside the set is refused; a declared value is substituted\n   * verbatim (it is a hostname or origin, not a path segment to encode).\n   *\n   * `hostSuffixes` additionally admits `<dns-label>(.<dns-label>)*` followed by one of the suffixes,\n   * for a vendor whose per-customer host is a subdomain it controls (Salesforce My Domain,\n   * `<name>.my.salesforce.com`). On a HOST placeholder a suffix applies only when the placeholder is\n   * the WHOLE host. On an ORIGIN placeholder it admits exactly `https://<dns-labels><suffix>` — the\n   * scheme fixed to https, no port, path, userinfo, query or fragment — which is what a per-customer\n   * origin such as a Dataverse environment URL (`https://<org>.crm4.dynamics.com`, #991) needs.\n   */\n  DECLARED_VALUES = 'DECLARED_VALUES',\n  /**\n   * Filled from the DEPLOYMENT's configured base URL for this provider — the REST contract's\n   * `baseUrl`, or the environment variable its `baseUrlEnvVarName` names. For a self-hosted vendor\n   * (Gitea) the operator names the instance once; a person connecting an account is never asked, and\n   * a value they supply is refused. Admitted in the ORIGIN position only.\n   */\n  DEPLOYMENT_BASE_URL = 'DEPLOYMENT_BASE_URL',\n  /**\n   * Filled from a deployment environment variable dedicated to THIS placeholder, named by the\n   * allowance's `envVarName` (#992). For a vendor whose endpoints sit on more than one per-tenant host\n   * — Workday's `https://{authHost}/…/authorize` and `https://{apiHost}/…/token` — one base URL cannot\n   * name both, so each host is its own operator setting (`WORKDAY_AUTH_HOST`, `WORKDAY_API_HOST`).\n   *\n   * Like DEPLOYMENT_BASE_URL, never asked of a person connecting, and a value they supply is refused.\n   * The trade is explicit: the application serves the one vendor tenant (data centre) the operator\n   * names. Admitted on a HOST placeholder that is the whole host, with a DNS-name value.\n   */\n  DEPLOYMENT_CONFIGURED = 'DEPLOYMENT_CONFIGURED',\n  /**\n   * DERIVED from another connect-time answer through a declared table (#1937): Microsoft Graph's operation host follows\n   * the login cloud the connection chose (`login.microsoftonline.com` → `graph.microsoft.com`), because a token minted by\n   * one national cloud is not accepted by another. The Microsoft source also maps the US Government login cloud; that\n   * row is declined (`unsupportedValues`), because US Government clouds are out of scope (decision of 2026-09-29).\n   *\n   * Never asked of a person and never taken from a request: the value is looked up from the ANSWER the connection\n   * stored for `answer`, and an answer the table does not name is refused. `whenUnanswered` is the host for a connection\n   * that answered nothing (the application's own pasted credential); absent, such a connection is refused. The table is\n   * the allow-list, so no other host can result. Admitted on a HOST placeholder that is the whole host.\n   *\n   * spec-cite: https://learn.microsoft.com/en-us/graph/deployments — \"Access tokens acquired for a national cloud\n   * deployment are not interchangeable with those acquired for the global service or any other national cloud.\"\n   */\n  DERIVED_FROM_CONNECTION_ANSWER = 'DERIVED_FROM_CONNECTION_ANSWER',\n}\n\nexport type ProviderOAuth2EndpointHostAllowance =\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DECLARED_VALUES;\n    /** Exact admitted values, compared case-insensitively. A hostname for HOST, an origin for ORIGIN. */\n    readonly values: readonly string[];\n    /**\n     * A whole HOST, or an ORIGIN (admitting `https://<labels><suffix>` only). Each MUST begin with `.`,\n     * so `evilmy.salesforce.com` never matches `.my.salesforce.com`.\n     */\n    readonly hostSuffixes?: readonly string[];\n    /**\n     * ORIGIN only: an admitted value must ALSO have the same origin as the deployment's configured base\n     * URL (the REST contract's `baseUrl` / `baseUrlEnvVarName`) (#991 review F4).\n     *\n     * For a vendor whose token is minted for a per-customer environment and whose operations dial the\n     * operator's configured instance — Dataverse mints for the scope's `{hostUrl}` while operations go to\n     * `MICROSOFT_DYNAMICS_CRM_BASE_URL` — a connection naming another environment would hold a token that\n     * fails every call. So the two are required to agree at connect, and an unset base URL refuses the\n     * connect as a deployment gap rather than minting a token nothing can use.\n     */\n    readonly originMatchesDeploymentBaseUrl?: true;\n    /** Values the vendor's source offers and the catalogue declines, with the reason. See {@link ProviderOAuth2UnsupportedValues}. */\n    readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;\n  }\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_CONFIGURED;\n    /**\n     * The deployment environment variable holding the host — derived by the transposer as\n     * `<PROVIDER_ENV_PREFIX>_<PLACEHOLDER_IN_SCREAMING_SNAKE>` and declared as a REGISTRATION secret slot,\n     * without which the runtime environment builder would strip it.\n     */\n    readonly envVarName: string;\n  }\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DERIVED_FROM_CONNECTION_ANSWER;\n    /** The connect-time answer the host is derived from (`cloud`) — itself a placeholder of the same provider. */\n    readonly answer: string;\n    /** Per answer value (compared case-insensitively), the host it selects. DNS names. */\n    readonly hosts: Readonly<Record<string, string>>;\n    /** The host when the connection answered nothing; absent, an unanswered connection is refused. */\n    readonly whenUnanswered?: string;\n    /**\n     * ANSWER values the vendor's source maps to a host and the catalogue declines, with the reason — so a stored\n     * connection carrying one is refused at use naming why. See {@link ProviderOAuth2UnsupportedValues}.\n     */\n    readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;\n  }\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_BASE_URL;\n    /**\n     * A path the configured base URL carries and the OAuth2 endpoints do NOT — stripped before\n     * substitution, and REQUIRED to be present. Gitea's operation base is `<instance>/api/v1` while\n     * its OAuth2 endpoints hang off `<instance>`; stripping keeps an instance served under a sub-path\n     * correct, where taking only the origin would drop it.\n     */\n    readonly baseUrlPathSuffix?: string;\n  };\n\n/** One `{placeholder}` occurrence in an OAuth2 endpoint template. */\nexport interface ProviderOAuth2EndpointPlaceholderOccurrence {\n  readonly name: string;\n  readonly position: ProviderOAuth2EndpointPlaceholderPosition;\n  /** Offset of the opening brace in the template. */\n  readonly index: number;\n  /** The whole `{name}` token, for substitution. */\n  readonly token: string;\n  /**\n   * HOST only: the token is the ENTIRE authority (`https://{cloud}/…`), as opposed to one part of it\n   * (`https://accounts.{location}/…`). A declared host SUFFIX is only meaningful for a whole host — on a\n   * partial one it would be concatenated with the text around it and admit a host nobody declared.\n   */\n  readonly occupiesWholeHost: boolean;\n  /**\n   * HOST only: when the token OPENS the authority and is followed by literal text up to the end of the authority —\n   * `https://{subdomain}.zendesk.com/…` → `.zendesk.com` — that literal text (#1015). A declared host SUFFIX equal to it\n   * bounds the composed host exactly as it bounds a whole host: the value is DNS labels, the template's own literal\n   * supplies the suffix, and `<labels>.zendesk.com` is the only shape that can result. Absent for a whole host, for a\n   * token that does not open the host (`accounts.{location}`), and for an ORIGIN or PATH token.\n   */\n  readonly literalHostSuffix?: string;\n}\n\n/**\n * Why an OAuth2 endpoint TEMPLATE cannot be resolved safely, whatever values are supplied.\n * See {@link findProviderOAuth2EndpointTemplateDefects}.\n */\nexport enum ProviderOAuth2EndpointTemplateDefect {\n  /**\n   * The template neither begins `http://` / `https://` nor begins with a placeholder. The WHATWG URL\n   * parser reads `https:/{h}/t`, `https:{h}/t` and `https:` + two backslashes + `{h}/t` as `https://h/t`, so a string scan\n   * for `://` would call `{h}` a PATH placeholder, encode it (a hostname survives encoding untouched),\n   * and send the request — and the client secret — to whatever a caller typed.\n   */\n  NOT_AN_ABSOLUTE_TEMPLATE = 'NOT_AN_ABSOLUTE_TEMPLATE',\n  /**\n   * An ORIGIN placeholder is followed by something other than `/`, `?`, `#` or the end —\n   * `{baseUrl}.evil.test/…`, `{baseUrl}:8443/…`, `{a}{b}/…`. The text after it would extend the host\n   * the origin value names.\n   */\n  ORIGIN_NOT_TERMINATED = 'ORIGIN_NOT_TERMINATED',\n  /**\n   * One authority carries more than one placeholder (`https://{a}{b}/…`, `https://{sub}.{domain}/…`).\n   * Each value validated alone can still compose a host no declaration admits.\n   */\n  SEVERAL_PLACEHOLDERS_IN_AUTHORITY = 'SEVERAL_PLACEHOLDERS_IN_AUTHORITY',\n  /**\n   * The authority after `://` is empty, begins with `/` or a backslash, or carries a backslash or `@`\n   * before the first `/`, `?` or `#`. The parser skips extra slashes (`https:///{h}/t` dials `{h}` as the\n   * HOST, while the `://` scan sees an empty authority and calls `{h}` a PATH), reads a backslash as a\n   * path separator, and\n   * reads text before `@` as userinfo — each makes the scan and the parser disagree about the host.\n   */\n  MALFORMED_AUTHORITY = 'MALFORMED_AUTHORITY',\n}\n\n/**\n * A DNS name: one or more LDH labels, lower-case (callers lower-case first).\n * spec-cite: RFC 1123 §2.1 (a label may begin with a digit) and RFC 1035 §2.3.1 (letters, digits,\n * hyphen; 63 octets per label).\n */\nexport const PROVIDER_OAUTH2_DNS_NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;\n\n/**\n * Why a DECLARED host allowance cannot be applied where its placeholder sits — the position rules the\n * transposer enforces at GENERATION time, so a broken declaration refuses the batch instead of being\n * emitted and refused at every connect. Empty when the allowance is sound.\n *\n * The runtime resolver refuses each of these too; this exists so they are caught where a human is\n * already looking at a diff rather than where a person is pressing Connect.\n */\nexport function describeProviderOAuth2EndpointHostAllowanceDefects(\n  placeholder: { readonly position: ProviderOAuth2EndpointPlaceholderPosition; readonly occupiesWholeHost: boolean; readonly literalHostSuffix?: string },\n  allowance: ProviderOAuth2EndpointHostAllowance,\n): readonly string[] {\n  const defects: string[] = [];\n  if (placeholder.position === ProviderOAuth2EndpointPlaceholderPosition.PATH_OR_QUERY) {\n    return ['a PATH or QUERY placeholder takes no host allowance'];\n  }\n  if (allowance.kind === ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_BASE_URL) {\n    if (placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.ORIGIN) {\n      defects.push('DEPLOYMENT_BASE_URL fills an ORIGIN only, and this placeholder does not begin its endpoint');\n    }\n    if (allowance.baseUrlPathSuffix !== undefined && !/^\\/[^?#]*[^/?#]$/.test(allowance.baseUrlPathSuffix)) {\n      defects.push(`baseUrlPathSuffix '${allowance.baseUrlPathSuffix}' must begin with '/' and name a path (no trailing '/', query or fragment)`);\n    }\n    return defects;\n  }\n  if (allowance.kind === ProviderOAuth2EndpointHostAllowanceKind.DERIVED_FROM_CONNECTION_ANSWER) {\n    if (placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.HOST || !placeholder.occupiesWholeHost) {\n      defects.push('DERIVED_FROM_CONNECTION_ANSWER fills a WHOLE HOST only, and this placeholder is not one');\n    }\n    if (typeof allowance.answer !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(allowance.answer)) {\n      defects.push(`answer '${String(allowance.answer)}' is not a placeholder name`);\n    }\n    const hosts = Object.values(allowance.hosts ?? {});\n    if (hosts.length === 0) defects.push('DERIVED_FROM_CONNECTION_ANSWER maps no answer to a host, which admits nothing');\n    for (const host of [...hosts, ...(allowance.whenUnanswered === undefined ? [] : [allowance.whenUnanswered])]) {\n      if (typeof host !== 'string' || !PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(host.toLowerCase())) defects.push(`'${String(host)}' is not a DNS name`);\n    }\n    defects.push(...describeProviderOAuth2UnsupportedValueDefects(allowance.unsupportedValues, Object.keys(allowance.hosts ?? {}), ProviderOAuth2ValueComparison.CASE_INSENSITIVE));\n    return defects;\n  }\n  if (allowance.kind === ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_CONFIGURED) {\n    if (placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.HOST || !placeholder.occupiesWholeHost) {\n      defects.push('DEPLOYMENT_CONFIGURED fills a WHOLE HOST only, and this placeholder is not one');\n    }\n    if (typeof allowance.envVarName !== 'string' || !/^[A-Z][A-Z0-9_]*$/.test(allowance.envVarName)) {\n      defects.push(`envVarName '${String(allowance.envVarName)}' is not an upper-case environment variable name`);\n    }\n    return defects;\n  }\n  if (allowance.originMatchesDeploymentBaseUrl === true && placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.ORIGIN) {\n    defects.push('originMatchesDeploymentBaseUrl applies to an ORIGIN only, and this placeholder is not one');\n  }\n  if (allowance.values.length === 0 && (allowance.hostSuffixes ?? []).length === 0) {\n    defects.push('DECLARED_VALUES admits nothing');\n  }\n  for (const value of allowance.values) {\n    if (placeholder.position === ProviderOAuth2EndpointPlaceholderPosition.ORIGIN) {\n      // Matched as text, not with `URL`: this package compiles without a DOM or Node lib. A lower-case\n      // `https://` + DNS name, with nothing after the host but an optional port, is exactly an origin as\n      // `URL#origin` would print it back.\n      const match = /^https:\\/\\/([^:/?#@]+)(?::\\d{1,5})?$/.exec(value);\n      if (match === null || !PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(match[1]!)) {\n        defects.push(`'${value}' is not an https origin (scheme and lower-case host only)`);\n      }\n    } else if (!PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(value.toLowerCase())) {\n      defects.push(`'${value}' is not a DNS name`);\n    }\n  }\n  for (const suffix of allowance.hostSuffixes ?? []) {\n    // An ORIGIN is a whole authority by construction (the scheme is then fixed to https); a HOST\n    // placeholder qualifies only when nothing surrounds it inside the authority.\n    // A placeholder that OPENS the host qualifies too, but only for the ONE suffix the template itself writes after\n    // it (#1015): any other suffix would be concatenated with that literal into a host nobody declared.\n    const opensHostWithThisSuffix = placeholder.literalHostSuffix !== undefined && placeholder.literalHostSuffix.toLowerCase() === suffix.toLowerCase();\n    if (placeholder.position === ProviderOAuth2EndpointPlaceholderPosition.HOST && !placeholder.occupiesWholeHost && !opensHostWithThisSuffix) {\n      defects.push(`host suffix '${suffix}' on a placeholder that is not the whole host`);\n      continue;\n    }\n    const labels = suffix.startsWith('.') ? suffix.slice(1) : '';\n    if (!PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(labels.toLowerCase()) || !labels.includes('.')) {\n      defects.push(`host suffix '${suffix}' must begin with '.' and name at least two DNS labels (a bare '.com' admits every host under a TLD)`);\n    }\n  }\n  defects.push(...describeProviderOAuth2UnsupportedValueDefects(allowance.unsupportedValues, allowance.values, ProviderOAuth2ValueComparison.CASE_INSENSITIVE));\n  for (const declined of Object.keys(allowance.unsupportedValues ?? {})) {\n    // A declined value a declared SUFFIX would still admit is admitted, whatever the reason says.\n    const coveringSuffix = (allowance.hostSuffixes ?? []).find((suffix) => declined.toLowerCase().endsWith(suffix.toLowerCase()));\n    if (coveringSuffix !== undefined) defects.push(`'${declined}' is declared unsupported but the host suffix '${coveringSuffix}' admits it`);\n  }\n  return defects;\n}\n\n/**\n * The defects that make a template unsafe to resolve, or an empty list. Shared by the runtime (which\n * refuses) and the transposer (which refuses to emit), so neither can admit a shape the other rejects.\n */\nexport function findProviderOAuth2EndpointTemplateDefects(template: string): readonly ProviderOAuth2EndpointTemplateDefect[] {\n  const defects: ProviderOAuth2EndpointTemplateDefect[] = [];\n  const leadingPlaceholder = /^\\{[A-Za-z_][A-Za-z0-9_]*\\}/.exec(template);\n  if (!/^https?:\\/\\//i.test(template) && leadingPlaceholder === null) {\n    return [ProviderOAuth2EndpointTemplateDefect.NOT_AN_ABSOLUTE_TEMPLATE];\n  }\n  if (leadingPlaceholder !== null) {\n    const next = template.charAt(leadingPlaceholder[0].length);\n    if (next !== '' && next !== '/' && next !== '?' && next !== '#') defects.push(ProviderOAuth2EndpointTemplateDefect.ORIGIN_NOT_TERMINATED);\n  } else {\n    const afterScheme = template.slice(template.indexOf('://') + 3);\n    const authorityEnd = afterScheme.search(/[/?#]/);\n    const authority = authorityEnd < 0 ? afterScheme : afterScheme.slice(0, authorityEnd);\n    if (authority === '' || authority.includes('\\\\') || authority.includes('@')) {\n      defects.push(ProviderOAuth2EndpointTemplateDefect.MALFORMED_AUTHORITY);\n      return defects;\n    }\n    const hostPlaceholders = classifyProviderOAuth2EndpointPlaceholders(template)\n      .filter((occurrence) => occurrence.position === ProviderOAuth2EndpointPlaceholderPosition.HOST);\n    if (hostPlaceholders.length > 1) defects.push(ProviderOAuth2EndpointTemplateDefect.SEVERAL_PLACEHOLDERS_IN_AUTHORITY);\n  }\n  return defects;\n}\n\n/** The placeholder syntax an endpoint template uses — the same braces the operation path templates use. */\nexport const PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN = /\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g;\n\n/**\n * Classify every placeholder in an OAuth2 endpoint template by the URL component it forms.\n *\n * ONE function, shared by the transposer (which decides which placeholders need an allowance) and\n * the runtime (which refuses an unallowed one), so the two cannot disagree about what a host is.\n *\n * Deliberately a string scan, not a URL parse: a template whose host is still `{cloud}` is not a\n * parseable URL, which is exactly the population this classifies.\n *\n * - offset 0 → {@link ProviderOAuth2EndpointPlaceholderPosition.ORIGIN};\n * - between the first `://` and the next `/`, `?` or `#` → HOST;\n * - otherwise → PATH_OR_QUERY.\n *\n * This classification is only meaningful for a template with no\n * {@link findProviderOAuth2EndpointTemplateDefects}: a template that does not begin `http(s)://` or a\n * placeholder has no authority this scan can find, and every consumer must refuse it FIRST rather than\n * trust the PATH_OR_QUERY answer it would get here.\n */\nexport function classifyProviderOAuth2EndpointPlaceholders(template: string): readonly ProviderOAuth2EndpointPlaceholderOccurrence[] {\n  const schemeSeparator = template.indexOf('://');\n  let authorityEnd = -1;\n  if (schemeSeparator >= 0) {\n    const rest = template.slice(schemeSeparator + 3);\n    const end = rest.search(/[/?#]/);\n    authorityEnd = end < 0 ? template.length : schemeSeparator + 3 + end;\n  }\n  const occurrences: ProviderOAuth2EndpointPlaceholderOccurrence[] = [];\n  for (const match of template.matchAll(PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN)) {\n    const index = match.index ?? 0;\n    const position = index === 0\n      ? ProviderOAuth2EndpointPlaceholderPosition.ORIGIN\n      : schemeSeparator >= 0 && index > schemeSeparator && index < authorityEnd\n        ? ProviderOAuth2EndpointPlaceholderPosition.HOST\n        : ProviderOAuth2EndpointPlaceholderPosition.PATH_OR_QUERY;\n    const occupiesWholeHost = position === ProviderOAuth2EndpointPlaceholderPosition.HOST\n      && index === schemeSeparator + 3\n      && index + match[0].length === authorityEnd;\n    const followingLiteral = position === ProviderOAuth2EndpointPlaceholderPosition.HOST && !occupiesWholeHost && index === schemeSeparator + 3\n      ? template.slice(index + match[0].length, authorityEnd)\n      : undefined;\n    // Only a PURELY literal remainder qualifies: a second placeholder in the authority is refused as malformed anyway.\n    const literalHostSuffix = followingLiteral !== undefined && followingLiteral.startsWith('.') && !followingLiteral.includes('{') ? followingLiteral : undefined;\n    occurrences.push({ name: match[1]!, position, index, token: match[0], occupiesWholeHost, ...(literalHostSuffix === undefined ? {} : { literalHostSuffix }) });\n  }\n  return occurrences;\n}\n\n\n/**\n * Vendors whose credential is COMPUTED per request rather than sent as a fixed header.\n *\n * A static header covers bearer tokens and API keys, which is most of the world. It cannot express a\n * signature: AWS Signature Version 4 signs the method, the canonical path, the sorted query, a\n * subset of headers, a SHA-256 of the payload and a timestamp, with a key derived from the secret,\n * the date, the region and the service — so the header's VALUE differs for every request and none of\n * its inputs exist when a provider module is authored.\n *\n * Until this existed, such a vendor could not be expressed at all — not badly, not partially. There\n * was no `if` to write, because the field where the answer goes did not exist. 45 transposed actions\n * across `amazon-s3`, `amazon-ses`, `amazon-textract`, `amazon-secrets-manager`, `amazon-sqs`,\n * `amazon-bedrock`, `azure-blob-storage`, `azure-communication-services` and `azure-openai` are\n * blocked on it (#373).\n */\nexport enum ProviderRestSigningScheme {\n  /**\n   * AWS Signature Version 4 — the `Authorization: AWS4-HMAC-SHA256 …` scheme used by every current\n   * AWS service API.\n   * spec-cite: AWS General Reference, \"Signature Version 4 signing process\"\n   * (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv4-signing-process.html)\n   */\n  AWS_SIGV4 = 'AWS_SIGV4',\n  /**\n   * Azure Storage shared-key — `Authorization: SharedKey <account>:<signature>` over a canonicalized\n   * request and resource.\n   * spec-cite: Azure Storage REST, \"Authorize with Shared Key\"\n   * (https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key)\n   */\n  AZURE_SHARED_KEY = 'AZURE_SHARED_KEY',\n}\n\n/**\n * How a provider signs each request.\n *\n * Declared by the provider module and executed by the engine, with NO vendor branch in the executor:\n * the scheme is data, and the signer dispatches on it exhaustively. That is the same discipline the\n * rest of the provider contract keeps — a consumer branches on a contract field, never on a\n * provider ref.\n *\n * The credential is TWO values for both schemes (an identity and a secret), and optionally a third\n * for temporary credentials, which is why it cannot ride in the single `apiKey.secretRef` slot.\n */\nexport interface ProviderRestRequestSigning {\n  readonly scheme: ProviderRestSigningScheme;\n  /** Env-var naming the identity half — an AWS access-key id, an Azure storage account name. */\n  readonly keyIdSecretRef: string;\n  /** Env-var naming the secret half. */\n  readonly secretKeySecretRef: string;\n  /**\n   * Env-var naming a session token, for temporary credentials (STS, a role assumption). Absent means\n   * long-lived credentials; present-but-unset is treated as long-lived rather than as an error,\n   * because the same provider serves both.\n   */\n  readonly sessionTokenSecretRef?: string;\n  /**\n   * AWS_SIGV4: the region and service that scope the derived key. Both are part of the SIGNATURE,\n   * not merely of the URL, so a wrong value fails authentication rather than routing — which is why\n   * they are declared rather than parsed out of the host.\n   */\n  readonly region?: string;\n  readonly service?: string;\n  /**\n   * Env-var overriding {@link region} per deployment, for an application that runs in more than one.\n   * The declared value is the default.\n   */\n  readonly regionEnvVarName?: string;\n}\n\n/**\n * The one function a generated typed client needs, as a TYPE.\n *\n * A generated provider package must not import the engine's runtime to be callable: that would put\n * the whole backend into the module graph of anything that touches a vendor, which is precisely the\n * weight #378 removed (models 20.8 MB against the backend barrel's 160.7 MB). So a client is a\n * FACTORY that takes the executor as an argument — the application wires its own, the package\n * declares only this signature, and nothing crosses at runtime.\n *\n * R3's ergonomics bought with a type rather than a dependency.\n *\n * ## The connection is a parameter, and OPTIONAL for a reason that is not convenience\n *\n * Omitted means the application's own account, acting as itself — the floor, and the only connection\n * that needs no store and no authorization. That default is what keeps the ordinary single-account\n * call as short as it should be.\n *\n * It could not be anything BUT a parameter. One execution may legitimately spend several tenants'\n * accounts — a user action pushing a message to every organization that user belongs to — so a client\n * that read the owner from ambient state could not vary it per call, and the fan-out would be\n * inexpressible through the generated surface even though the engine beneath it supports one.\n */\nexport type ProviderOperationExecute = (\n  providerRef: string,\n  operationId: string,\n  input: Readonly<Record<string, unknown>>,\n  connection?: ExternalProvider_ConnectionTarget,\n) => Promise<unknown>;\n"]}
+{"version":3,"file":"rest-operations.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/rest-operations.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAQH,wJAAwJ;AACxJ,oDAAoD;AACpD,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,sGAAsG;IACtG,8CAAa,CAAA;IACb,gDAAe,CAAA;IACf,kDAAiB,CAAA;AACnB,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,+BAaX;AAbD,WAAY,+BAA+B;IACzC,gDAAa,CAAA;IACb,sEAAmC,CAAA;IACnC,0DAAuB,CAAA;IACvB,uFAAuF;IACvF,gDAAa,CAAA;IACb;;;;;OAKG;IACH,oDAAiB,CAAA;AACnB,CAAC,EAbW,+BAA+B,KAA/B,+BAA+B,QAa1C;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,4BAcX;AAdD,WAAY,4BAA4B;IACtC,wFAAwF;IACxF,6CAAa,CAAA;IACb,oGAAoG;IACpG,6CAAa,CAAA;IACb,qGAAqG;IACrG,6CAAa,CAAA;IACb;;;;;OAKG;IACH,iDAAiB,CAAA;AACnB,CAAC,EAdW,4BAA4B,KAA5B,4BAA4B,QAcvC;AAUD;;;;GAIG;AACH,MAAM,CAAN,IAAY,2BAMX;AAND,WAAY,2BAA2B;IACrC,gDAAiB,CAAA;IACjB,4CAAa,CAAA;IACb,gDAAiB,CAAA;IACjB,qFAAqF;IACrF,4CAAa,CAAA;AACf,CAAC,EANW,2BAA2B,KAA3B,2BAA2B,QAMtC;AAqRD,gHAAgH;AAChH,MAAM,CAAN,IAAY,kCAOX;AAPD,WAAY,kCAAkC;IAC5C,kCAAkC;IAClC,6DAAuB,CAAA;IACvB,4GAA4G;IAC5G,yDAAmB,CAAA;IACnB,yGAAyG;IACzG,2DAAqB,CAAA;AACvB,CAAC,EAPW,kCAAkC,KAAlC,kCAAkC,QAO7C;AAQD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,0BAA0B,CAAC;AAE3E;;;GAGG;AACH,MAAM,UAAU,6CAA6C,CAAC,OAAuC;IACnG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,mCAAmC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,uCAAuC,OAAO,CAAC,eAAe,qBAAqB,CAAC,CAAC;IAC3I,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,qCAAqC,OAAO,CAAC,aAAa,qBAAqB,CAAC,CAAC;IACrI,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,2BAA2B,IAAI,EAAE,EAAE,CAAC;QAC7D,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,yDAAyD,IAAI,8EAA8E,CAAC,CAAC;QAC5J,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAG,UAAU,CAAC;AAEzE,gHAAgH;AAChH,MAAM,CAAC,MAAM,wCAAwC,GAAG,mDAAmD,CAAC;AAE5G,sHAAsH;AACtH,MAAM,CAAN,IAAY,mCAKX;AALD,WAAY,mCAAmC;IAC7C,mFAAmF;IACnF,8DAAuB,CAAA;IACvB,iDAAiD;IACjD,wDAAiB,CAAA;AACnB,CAAC,EALW,mCAAmC,KAAnC,mCAAmC,QAK9C;AA8DD;;;;GAIG;AACH,MAAM,UAAU,4CAA4C,CAAC,WAA0C;IACrG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjH,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,WAAW,CAAC,QAAQ,sCAAsC,8CAA8C,EAAE,CAAC,CAAC;IACjL,IAAI,SAAS,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,sCAAsC,8CAA8C,kCAAkC,CAAC,CAAC;IACjM,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,sCAAsC,WAAW,CAAC,eAAe,6CAA6C,8CAA8C,EAAE,CAAC,CAAC;IAC1O,MAAM,IAAI,GAAG,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACjF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,WAAW,CAAC,QAAQ,mCAAmC,CAAC,CAAC;IAC7H,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACrG,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;QAC/C,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,uCAAuC,SAAS,4BAA4B,CAAC,CAAC;IAClK,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxG,OAAO,CAAC,IAAI,CAAC,qCAAqC,IAAI,oCAAoC,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACtF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAC;QAClF,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,iDAAiD,IAAI,6BAA6B,CAAC,CAAC;QACjJ,IAAI,IAAI,CAAC,MAAM,KAAK,mCAAmC,CAAC,MAAM,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAC5G,OAAO,CAAC,IAAI,CAAC,2CAA2C,IAAI,wDAAwD,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,4BAA4B,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,4BAA4B,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9G,OAAO,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,IAAa,EAAE,IAAY;IAC9C,IAAI,OAAO,GAAY,IAAI,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1G,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAa,EAAE,aAAqB;IAC9E,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC9C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpG,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,kCAAkC,CAChD,IAAa,EACb,OAAkF;IAElF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,kCAAkC,CAAC,SAAS,EAAE,CAAC;IACjF,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,kCAAkC,CAAC,QAAQ,EAAE,CAAC;IACjF,MAAM,SAAS,GAAG,2BAA2B,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3E,OAAO,SAAS,KAAK,SAAS;QAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,kCAAkC,CAAC,OAAO,EAAE;QACtD,CAAC,CAAC,EAAE,IAAI,EAAE,kCAAkC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;AACtE,CAAC;AAiBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,8CAA8C,CAC5D,SAAoD,EACpD,6BAA+C;IAE/C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,6BAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtG,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,OAAO,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC;SAChC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,6BAA6B,CAAC,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;SAChI,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAgCD,wJAAwJ;AACxJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,2BAKX;AALD,WAAY,2BAA2B;IACrC,oGAAoG;IACpG,wDAAyB,CAAA;IACzB,yHAAyH;IACzH,8CAAe,CAAA;AACjB,CAAC,EALW,2BAA2B,KAA3B,2BAA2B,QAKtC;AAwBD;;;;;GAKG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IACjB,yCAAmB,CAAA;AACrB,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAAC,KAGjD;IACC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,YAAkE,EAAQ,EAAE;QACxG,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,iDAAiD,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACrH,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;gBAClF,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,yCAAyC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/G,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChF,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,gBAAgB,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;YACvH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;QAAE,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClG,OAAO,CAAC,IAAI,CAAC,gIAAgI,CAAC,CAAC;IACjJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAGpD;IACC,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC;AAC3G,CAAC;AA4TD,iJAAiJ;AACjJ,6HAA6H;AAC7H,MAAM,CAAC,MAAM,2CAA2C,GAAG,kBAAkB,CAAC;AAE9E,oIAAoI;AACpI,MAAM,CAAN,IAAY,0BAeX;AAfD,WAAY,0BAA0B;IACpC;;;OAGG;IACH,mDAAqB,CAAA;IACrB;;;;;;;OAOG;IACH,uDAAyB,CAAA;AAC3B,CAAC,EAfW,0BAA0B,KAA1B,0BAA0B,QAerC;AAgCD,uHAAuH;AACvH,MAAM,UAAU,gCAAgC,CAAC,QAAoC,EAAE,IAAY;IACjG,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1F,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACtF,OAAO,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mCAAmC,CACjD,MAAiE,EACjE,IAAY;IAEZ,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,gCAAgC,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;IACxH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0IAA0I;AAC1I,MAAM,UAAU,oCAAoC,CAAC,QAAwD;IAC3G,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,2CAA2C,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uCAAuC,CAAC,QAAoC,EAAE,MAAc;IAC1G,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,2CAA2C,CAAC;QACtG,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,MAAM,CAAC,EAAE;QAC/E,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAkF,EAClF,KAAa;IAEb,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC;IAC3E,+GAA+G;IAC/G,IAAI,MAAM,CAAC,YAAY,KAAK,0BAA0B,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC;IACjG,qHAAqH;IACrH,mHAAmH;IACnH,oDAAoD;IACpD,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,SAAS,CAAC,UAAU,CAAC,2CAA2C,CAAC,EAAE,CAAC;gBACtE,IAAI,IAAI,KAAK,SAAS,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gCAAgC,CAAC,QAAQ,EAAE,IAAI,CAAC;oBAAE,OAAO,EAAE,CAAC;gBACrI,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CACtD,MAAkF,EAClF,KAAa;IAEb,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,+BAA+B,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,SAAS,CAAC;AACtE,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,uCAAuC,CACrD,IAAY,EACZ,QAAoH;IAEpH,IAAI,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,OAAO,SAAS,IAAI,uEAAuE,CAAC;IAC9F,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,SAAS,IAAI,uIAAuI,CAAC;IAC9J,CAAC;IACD,wHAAwH;IACxH,wHAAwH;IACxH,2BAA2B;IAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAClI,MAAM,QAAQ,GAAG,SAAS,KAAK,SAAS,IAAI,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,IAAI,0HAA0H,CAAC;IAC3K,MAAM,YAAY,GAAG,mCAAmC,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpF,MAAM,YAAY,GAAG,mCAAmC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChF,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,IAAI,wDAAwD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACjK,IAAI,YAAY,EAAE,EAAE,KAAK,YAAY,CAAC,EAAE,EAAE,CAAC;QACzC,OAAO,SAAS,IAAI,8BAA8B,YAAY,CAAC,EAAE,cAAc,YAAY,EAAE,EAAE,IAAI,QAAQ,sHAAsH,CAAC;IACpO,CAAC;IACD,qHAAqH;IACrH,6FAA6F;IAC7F,IAAI,IAAI,KAAK,QAAQ,IAAI,oCAAoC,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,OAAO,SAAS,IAAI,wCAAwC,YAAY,CAAC,EAAE,oEAAoE,CAAC;IAClJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yEAAyE;AAEzE,2JAA2J;AAC3J;;GAEG;AACH,MAAM,CAAN,IAAY,oCAiBX;AAjBD,WAAY,oCAAoC;IAC9C;;;;;;OAMG;IACH,6DAAqB,CAAA;IACrB;;;;;;OAMG;IACH,yFAAiD,CAAA;AACnD,CAAC,EAjBW,oCAAoC,KAApC,oCAAoC,QAiB/C;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,+BAiBX;AAjBD,WAAY,+BAA+B;IACzC;;;;;;;;;;;;;;OAcG;IACH,8EAA2C,CAAA;AAC7C,CAAC,EAjBW,+BAA+B,KAA/B,+BAA+B,QAiB1C;AAED,mGAAmG;AACnG,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,gGAAgG;IAChG,0CAAa,CAAA;IACb,mFAAmF;IACnF,0DAA6B,CAAA;AAC/B,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,gCAUX;AAVD,WAAY,gCAAgC;IAC1C;;;;;;;OAOG;IACH,mDAAe,CAAA;AACjB,CAAC,EAVW,gCAAgC,KAAhC,gCAAgC,QAU3C;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAAa,EAAE,SAAuD;IACrH,MAAM,SAAS,GAAG,SAAS,KAAK,gCAAgC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3F,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAAC,MAAyB,EAAE,SAAuD;IAClI,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,gCAAgC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACvF,CAAC;AAiBD,mFAAmF;AAEnF;;;;;;;;;GASG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAA6F;IACjJ,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,eAAe,iCAAiC,CAAC,CAAC;IACnI,CAAC;IACD,iHAAiH;IACjH,IAAI,MAAM,CAAC,YAAY,KAAK,0BAA0B,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvG,OAAO,CAAC,2HAA2H,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtK,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACrG,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,8BAA8B,CAAC,CAAC;IAC1H,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;QAC5I,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,+BAA+B,MAAM,+BAA+B,CAAC,CAAC;QAC1M,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,wBAAwB,KAAK,4BAA4B,CAAC,CAAC;QAC1J,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAC;QAC9F,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrJ,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,KAAK,gDAAgD,2CAA2C,EAAE,CAAC,CAAC;QACjM,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,UAAU,CAAC,2CAA2C,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,eAAe,iBAAiB,KAAK,gFAAgF,CAAC,CAAC;iBAClO,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,eAAe,iBAAiB,KAAK,+CAA+C,CAAC,CAAC;QACtL,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACpD,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAE,CAAC;YAC9C,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;YACjD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;mBAC1G,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;mBAC/F,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;YAClO,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,cAAc,MAAM,UAAU,OAAO,6DAA6D,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAN,IAAY,gCAYX;AAZD,WAAY,gCAAgC;IAC1C,4GAA4G;IAC5G,qEAAiC,CAAA;IACjC;;;;;;;OAOG;IACH,uEAAmC,CAAA;AACrC,CAAC,EAZW,gCAAgC,KAAhC,gCAAgC,QAY3C;AA0BD,6FAA6F;AAC7F,MAAM,CAAN,IAAY,oCAWX;AAXD,WAAY,oCAAoC;IAC9C;;;OAGG;IACH,iFAAyC,CAAA;IACzC;;;OAGG;IACH,2GAAmE,CAAA;AACrE,CAAC,EAXW,oCAAoC,KAApC,oCAAoC,QAW/C;AAeD,iHAAiH;AACjH,MAAM,CAAN,IAAY,8BASX;AATD,WAAY,8BAA8B;IACxC,kGAAkG;IAClG,mDAAiB,CAAA;IACjB,8FAA8F;IAC9F,qEAAmC,CAAA;IACnC,4EAA4E;IAC5E,yEAAuC,CAAA;IACvC,uDAAuD;IACvD,qDAAmB,CAAA;AACrB,CAAC,EATW,8BAA8B,KAA9B,8BAA8B,QASzC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAqD,EACrD,QAAkG;IAElG,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,8BAA8B,CAAC,MAAM,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpG,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,YAAY,EAAE,IAAY,EAAE,EAAE;QACrF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM;QAAE,OAAO,8BAA8B,CAAC,eAAe,CAAC;IACnG,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,SAAS,GAAuB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtF,iHAAiH;IACjH,iGAAiG;IACjG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,8BAA8B,CAAC,iBAAiB,CAAC;IAChJ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,QAAQ,CAAC,eAAe;QAAE,OAAO,8BAA8B,CAAC,OAAO,CAAC;IAChJ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qCAAqC,CAAC,WAA6C,EAAE,MAAqD;IACxJ,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,oCAAoC,CAAC,kBAAkB;YAC1D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACxH,KAAK,oCAAoC,CAAC,+BAA+B,CAAC,CAAC,CAAC;YAC1E,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3G,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAC;QACtD,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,WAAW,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAAC,MAA6G;IAC3K,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC;IACtD,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,gCAAgC,CAAC,eAAe,CAAC,CAAC;IAC5J,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,2GAA2G,CAAC,CAAC;IACzK,qGAAqG;IACrG,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,wHAAwH,CAAC,CAAC;IACzI,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,+DAA+D,CAAC,CAAC;IAClJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,wBAAwB,KAAK,iBAAiB,CAAC,CAAC;QACxG,IAAI,WAAW,CAAC,IAAI,KAAK,oCAAoC,CAAC,kBAAkB,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpH,OAAO,CAAC,IAAI,CAAC,wBAAwB,KAAK,KAAK,WAAW,CAAC,KAAK,gDAAgD,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,KAAK,oCAAoC,CAAC,+BAA+B,IAAI,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7I,OAAO,CAAC,IAAI,CAAC,wBAAwB,KAAK,KAAK,WAAW,CAAC,KAAK,2BAA2B,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AA4BD,iEAAiE;AACjE,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,yFAAyF;IACzF,sEAAqC,CAAA;IACrC,iFAAiF;IACjF,gDAAe,CAAA;AACjB,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAED;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,iBAA8D,EAC9D,KAAa,EACb,UAAyC;IAEzC,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,GAAG,GAAG,UAAU,KAAK,6BAA6B,CAAC,KAAK;QAC5D,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACxG,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,6CAA6C,CACpD,iBAA8D,EAC9D,QAA2B,EAC3B,UAAyC;IAEzC,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,CAAC,UAAU,KAAK,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAChI,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,6CAA6C,CAAC,CAAC;QAC5G,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,KAAK,oBAAoB,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sCAWX;AAXD,WAAY,sCAAsC;IAChD;;;OAGG;IACH,2DAAiB,CAAA;IACjB;;;OAGG;IACH,qEAA2B,CAAA;AAC7B,CAAC,EAXW,sCAAsC,KAAtC,sCAAsC,QAWjD;AAED,6HAA6H;AAC7H,MAAM,CAAN,IAAY,iCAWX;AAXD,WAAY,iCAAiC;IAC3C;;;;OAIG;IACH,0GAAqE,CAAA;IACrE,8GAA8G;IAC9G,kFAA6C,CAAA;IAC7C,iHAAiH;IACjH,gEAA2B,CAAA;AAC7B,CAAC,EAXW,iCAAiC,KAAjC,iCAAiC,QAW5C;AAUD;;;GAGG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAAa;IAClE,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,4CAA4C,CAAC,CAAC,CAAC;IACtF,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,4CAA4C,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAwC,EAAE,CAAC;IACxD,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,WAAW,CAAC,CAAC;IACxI,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,oBAAoB,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,gCAAgC,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAAa;IAClE,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE;QACf,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,WAAW,CAAC,CAAC,CAAC,sCAAsC,CAAC,MAAM;QAC/I,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;KAChB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,mCAAmC,GAAG,qCAAqC,CAAC;AAElF;;;GAGG;AACH,MAAM,UAAU,gDAAgD,CAAC,SAA4C;IAC3G,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,wCAAwC,CAAC,CAAC;IACzH,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjI,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,6CAA6C,CAAC,SAAS,CAAC,iBAAiB,EAAE,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC;IACnJ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,yCAeX;AAfD,WAAY,yCAAyC;IACnD;;;;OAIG;IACH,8DAAiB,CAAA;IACjB;;;;OAIG;IACH,0DAAa,CAAA;IACb,oGAAoG;IACpG,4EAA+B,CAAA;AACjC,CAAC,EAfW,yCAAyC,KAAzC,yCAAyC,QAepD;AAED,sHAAsH;AACtH,MAAM,CAAN,IAAY,uCA+CX;AA/CD,WAAY,uCAAuC;IACjD;;;;;;;;;;;OAWG;IACH,8EAAmC,CAAA;IACnC;;;;;OAKG;IACH,sFAA2C,CAAA;IAC3C;;;;;;;;;OASG;IACH,0FAA+C,CAAA;IAC/C;;;;;;;;;;;;;OAaG;IACH,4GAAiE,CAAA;AACnE,CAAC,EA/CW,uCAAuC,KAAvC,uCAAuC,QA+ClD;AAoFD;;;GAGG;AACH,MAAM,CAAN,IAAY,oCA2BX;AA3BD,WAAY,oCAAoC;IAC9C;;;;;OAKG;IACH,6FAAqD,CAAA;IACrD;;;;OAIG;IACH,uFAA+C,CAAA;IAC/C;;;OAGG;IACH,+GAAuE,CAAA;IACvE;;;;;;OAMG;IACH,mFAA2C,CAAA;AAC7C,CAAC,EA3BW,oCAAoC,KAApC,oCAAoC,QA2B/C;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,mFAAmF,CAAC;AAEpI;;;;;;;GAOG;AACH,MAAM,UAAU,kDAAkD,CAChE,WAAuJ,EACvJ,SAA8C;IAE9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,aAAa,EAAE,CAAC;QACrF,OAAO,CAAC,qDAAqD,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,uCAAuC,CAAC,mBAAmB,EAAE,CAAC;QACnF,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,MAAM,EAAE,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,sBAAsB,SAAS,CAAC,iBAAiB,4EAA4E,CAAC,CAAC;QAC9I,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,uCAAuC,CAAC,8BAA8B,EAAE,CAAC;QAC9F,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/F,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QACtH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,6CAA6C,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,6BAA6B,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAChL,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,uCAAuC,CAAC,qBAAqB,EAAE,CAAC;QACrF,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,kDAAkD,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,8BAA8B,KAAK,IAAI,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,MAAM,EAAE,CAAC;QACnI,OAAO,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,MAAM,EAAE,CAAC;YAC9E,iGAAiG;YACjG,mGAAmG;YACnG,oCAAoC;YACpC,MAAM,KAAK,GAAG,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,4DAA4D,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAClD,6FAA6F;QAC7F,6EAA6E;QAC7E,gHAAgH;QAChH,oGAAoG;QACpG,MAAM,uBAAuB,GAAG,WAAW,CAAC,iBAAiB,KAAK,SAAS,IAAI,WAAW,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QACpJ,IAAI,WAAW,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC1I,OAAO,CAAC,IAAI,CAAC,gBAAgB,MAAM,+CAA+C,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,gBAAgB,MAAM,sGAAsG,CAAC,CAAC;QAC7I,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,6CAA6C,CAAC,SAAS,CAAC,iBAAiB,EAAE,SAAS,CAAC,MAAM,EAAE,6BAA6B,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9J,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,8FAA8F;QAC9F,MAAM,cAAc,GAAG,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC9H,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,kDAAkD,cAAc,aAAa,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yCAAyC,CAAC,QAAgB;IACxE,MAAM,OAAO,GAA2C,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACnE,OAAO,CAAC,oCAAoC,CAAC,wBAAwB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,qBAAqB,CAAC,CAAC;IAC5I,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACtF,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,mBAAmB,CAAC,CAAC;YACvE,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC,QAAQ,CAAC;aAC1E,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,yCAAyC,CAAC,IAAI,CAAC,CAAC;QAClG,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,iCAAiC,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,4CAA4C,GAAG,+BAA+B,CAAC;AAE5F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,0CAA0C,CAAC,QAAgB;IACzE,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,YAAY,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,GAAG,GAAG,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,GAAkD,EAAE,CAAC;IACtE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,4CAA4C,CAAC,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC;YAC1B,CAAC,CAAC,yCAAyC,CAAC,MAAM;YAClD,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,KAAK,GAAG,eAAe,IAAI,KAAK,GAAG,YAAY;gBACvE,CAAC,CAAC,yCAAyC,CAAC,IAAI;gBAChD,CAAC,CAAC,yCAAyC,CAAC,aAAa,CAAC;QAC9D,MAAM,iBAAiB,GAAG,QAAQ,KAAK,yCAAyC,CAAC,IAAI;eAChF,KAAK,KAAK,eAAe,GAAG,CAAC;eAC7B,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC;QAC9C,MAAM,gBAAgB,GAAG,QAAQ,KAAK,yCAAyC,CAAC,IAAI,IAAI,CAAC,iBAAiB,IAAI,KAAK,KAAK,eAAe,GAAG,CAAC;YACzI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC;YACvD,CAAC,CAAC,SAAS,CAAC;QACd,mHAAmH;QACnH,MAAM,iBAAiB,GAAG,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/J,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;IAChK,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAGD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAN,IAAY,yBAeX;AAfD,WAAY,yBAAyB;IACnC;;;;;OAKG;IACH,oDAAuB,CAAA;IACvB;;;;;OAKG;IACH,kEAAqC,CAAA;AACvC,CAAC,EAfW,yBAAyB,KAAzB,yBAAyB,QAepC","sourcesContent":["/**\n * The REST OPERATION vocabulary — what an operation IS, independent of who executes one.\n *\n * Moved here from `@wildo-ai/external-connectors-private/backend` on 2026-09-06 (#378), and the\n * reason is a measurement rather than tidiness. A generated provider's operation catalogue is loaded\n * LAZILY on purpose: the loader contract forbids evaluating it at boot, because a provider whose\n * operations are eager puts every vendor's operations into every process's boot graph. But the\n * catalogue module needs `ProviderRestParameterLocation` and `ProviderRestRequestBodyEncoding` as\n * VALUES, and their only public door was the backend barrel — so reading two string enums pulled the\n * entire backend provider surface in behind them:\n *\n * | import | heap | time |\n * |---|---|---|\n * | `@wildo-ai/external-connectors-models` | 20.8 MB | 39 ms |\n * | `@wildo-ai/external-connectors-private/backend` | 160.7 MB | 251 ms |\n *\n * 161 MB to answer \"is this parameter in the path or the query\". The vocabulary belongs here for a\n * reason that survives the measurement, too: it describes what an operation IS — its method, its\n * path template, where its parameters ride — and none of that is backend runtime. The arrow already\n * pointed this way, since this package has no dependency on the private backend and the private\n * backend depends on it.\n *\n * ## This is the ONLY description of a REST provider — two earlier ones were deleted\n *\n * `rest-api.external-connectors-models.schemas.ts` described REST providers twice over, and both\n * descriptions are gone. Neither should come back beside this module.\n *\n * - **An OpenAPI-shaped operation layer** (`REST_API_OperationSpecSchema`,\n *   `REST_API_OperationContextSchema`, `REST_API_OperationDefinition`, `API_Parameter*`,\n *   `API_ContentType`) — deleted 2026-09-06 by #331. Ten exported symbols and zero code readers: a\n *   provider that authored one compiled, shipped, and was invisible to every runtime.\n * - **A profile / configuration / status triple** (`REST_API_Provider_Profile`,\n *   `REST_API_Provider_Configuration`, `REST_APIProvider_StatusSchema`) — deleted 2026-09-12 (#18).\n *   Its only reader was the `ExternalProvider_ExchangeProtocol` union, itself read by nothing but a\n *   drift test pinning it to the enum, and deleted in the same change. Its `pagination.style` was an\n *   anonymous `\"offset\" | \"cursor\" | \"page\" | \"link\"` restating {@link ProviderRestPaginationStyle}.\n *\n * WHERE a REST API lives and how it authenticates is the `rest` arm of the backend runtime contract\n * (`@wildo-ai/external-connectors-private/backend`); WHAT can be called against it is\n * {@link ProviderRestOperation}, executed by `ProviderOperationExecutorBackendService`. A second\n * description of either is not a missing feature — it is the drift that makes an authoring surface\n * untrustworthy, because an author cannot tell which of two shapes is the one that runs. If an\n * OpenAPI document is ever read (a second mapper input), it feeds `ProviderRestOperation` like\n * every other source.\n */\n\nimport { z } from 'zod';\n\nimport { API_HttpMethod } from '../core/commons.external-connectors-models.schemas';\nimport { ExternalOperation_Classification } from '../core/operation-classification.external-connectors-models.schemas';\nimport type { ExternalProvider_ConnectionTarget } from '../core/security.external-connectors-models.schemas';\n\n/** @wildo_source:part:start external-connectors.models.rest-operation-contract facet:layer:shared facet:family:provider facet:audience:app-developer */\n/** Where a declared parameter rides on the wire. */\nexport enum ProviderRestParameterLocation {\n  /** Substituted into a `{token}` of the path template. Always required — a path cannot have a hole. */\n  PATH = 'path',\n  QUERY = 'query',\n  HEADER = 'header',\n}\n\n/**\n * How the request body is encoded. The ETL read surface only ever needed JSON; a hand-authored\n * write reaches vendors that take form bodies (OAuth-adjacent endpoints, older CRMs) and file\n * uploads, so the encoding is DECLARED per operation rather than inferred from the method.\n */\nexport enum ProviderRestRequestBodyEncoding {\n  JSON = 'json',\n  FORM_URLENCODED = 'form-urlencoded',\n  MULTIPART = 'multipart',\n  /** A raw text body; `contentType` on the declaration says which media type is sent. */\n  TEXT = 'text',\n  /**\n   * Raw bytes (#367, folding #364) — an image, a PDF, a file upload a vendor takes as the whole body.\n   * `contentType` is REQUIRED, by the TEXT arm's rule: a body without its media type is not addressable.\n   * The input must supply a `Uint8Array` (a Node `Buffer` is one); nothing is converted into bytes here,\n   * because a string encoded under a guessed charset is exactly how an upload arrives corrupted.\n   */\n  BINARY = 'binary',\n}\n\n/**\n * How the vendor's ANSWER is read (#367, folding #364).\n *\n * The request side could already send TEXT and the transport could already read TEXT and NONE, while\n * the operation declaration could only say JSON — so an operation against a `text/csv` export could be\n * authored and then failed at runtime as `INVALID_JSON`, a contract-breach message for a declaration\n * the contract had no way to state. This is the missing half of that asymmetry.\n */\nexport enum ProviderRestResponseDecoding {\n  /** Parse the body as JSON. The default, and what an absent `responseDecoding` means. */\n  JSON = 'json',\n  /** Keep the body as text — a CSV export, an XML document. The operation's output is that string. */\n  TEXT = 'text',\n  /** Read nothing — a write whose answer carries no information (a 204). The output is `undefined`. */\n  NONE = 'none',\n  /**\n   * Keep the raw bytes — a signed PDF, an evidence container (#2910). Requires `binaryResponse` (a byte ceiling and the\n   * accepted media types); the output is `{ bytes, contentType }`. The bytes are the vendor's, unscanned: do not relay\n   * them to a person or write them as a file yourself. Keep one through `ProviderDocumentFileWriterBackendService`\n   * (`@wildo-ai/saas-backend-lib`, #2963), which stores it as a scanned file (`scan: REQUIRED`) whatever the caller asks.\n   */\n  BINARY = 'binary',\n}\n\n/** The bounds a {@link ProviderRestResponseDecoding.BINARY} answer is read under (#2910). Both mandatory. */\nexport interface ProviderRestBinaryResponse {\n  /** The most bytes the vendor's answer may hold. Enforced while streaming; a larger answer is refused, never truncated. */\n  readonly maxBytes: number;\n  /** Media types accepted (`application/pdf`), compared on the type alone, case-insensitively. */\n  readonly acceptedContentTypes: readonly string[];\n}\n\n/**\n * How a listing operation continues. A HINT the caller reads, never something the executor acts\n * on: an executor that paged on its own would decide a caller's memory budget for it, and the\n * ETL lane already owns paging as a discipline (drift-safe continuation only).\n */\nexport enum ProviderRestPaginationStyle {\n  OFFSET = 'offset',\n  PAGE = 'page',\n  CURSOR = 'cursor',\n  /** The vendor returns its own continuation URL (`@odata.nextLink`, `links.next`). */\n  LINK = 'link',\n}\n\n/** One declared parameter: a wire name, where it rides, and which input field feeds it. */\nexport interface ProviderRestOperationParameter {\n  /** The name ON THE WIRE (`page_size`, `X-Vendor-Version`, or the `{token}` in the path). */\n  readonly name: string;\n  readonly in: ProviderRestParameterLocation;\n  /**\n   * The INPUT field that feeds it, when the two differ (`pageSize` → `page_size`). Absent means\n   * the input field is spelled exactly like the wire name. Declared, never camel/snake-guessed:\n   * a guess that is wrong drops a parameter silently and the vendor answers a valid-looking\n   * default page.\n   */\n  readonly from?: string;\n  /** PATH parameters are required whatever this says; for QUERY/HEADER, absent means optional. */\n  readonly required?: boolean;\n  /** A literal value sent on every call — for a version pin or a fixed format selector. */\n  readonly constantValue?: string;\n  /**\n   * PATH only (#2663): the value may hold several `/`-separated segments, each percent-encoded on its own, instead of\n   * one segment whose `/` is encoded. For a vendor that routes per region or tenant inside ONE origin: the Bot\n   * Connector's `serviceUrl` is `https://smba.trafficmanager.net/<region>/…`, and an operation's path begins with that\n   * region path. Empty segments, `.` and `..` are refused, so the value moves the path within the base origin and never\n   * above it; the origin itself cannot move, as for every path value.\n   */\n  readonly multiSegment?: true;\n  readonly description?: string;\n}\n\n/** How the request body is built from the operation's input. */\nexport interface ProviderRestOperationRequestBody {\n  readonly encoding: ProviderRestRequestBodyEncoding;\n  /**\n   * The input field carrying the whole body. Absent = the body is every input field NOT consumed\n   * by a declared parameter — the ordinary shape, and the reason parameters declare `from`.\n   */\n  readonly from?: string;\n  /** For `TEXT` and `BINARY`: the media type actually sent (`text/csv`, `application/pdf`). Required for both. */\n  readonly contentType?: string;\n  /**\n   * A JSON body sent INSIDE one named property: `envelope: 'data'` sends `{ \"data\": { …the body… } }` (#333).\n   *\n   * Asana answers `data: Missing input` to a task whose fields arrive at the top level — its API reads\n   * every write from a `data` wrapper, which the source catalogue builds in its request helper and the\n   * transposer never saw. Declared here rather than modelled as a nested input, so the INPUT stays flat:\n   * the fields a person fills in, and the fields an `inputOptions` key names, are the fields they see.\n   *\n   * JSON only. Any other encoding with an envelope is refused by name when the request is compiled — a\n   * form, text or binary body has no property to wrap it in.\n   */\n  readonly envelope?: string;\n}\n\n/** Where the payload sits inside a response, and how a listing continues. */\nexport interface ProviderRestOperationPagination {\n  readonly style: ProviderRestPaginationStyle;\n  /** OFFSET/PAGE/CURSOR: the request parameter names the caller advances. */\n  readonly limitParam?: string;\n  readonly offsetParam?: string;\n  readonly pageParam?: string;\n  readonly cursorParam?: string;\n  /** CURSOR/LINK: dot-path in the RESPONSE carrying the next cursor or the next URL. */\n  readonly nextPath?: string;\n}\n\n/**\n * Where an input's CHOICES come from: another operation of the same provider, run through the SAME\n * connection, whose answer lists the values a person may pick (#333).\n *\n * The shape every workflow product converged on, and deliberately not a value stored on the connection.\n * A workspace, a project, a channel are choices WITHIN an account, made per call: Zapier fills a\n * dynamic dropdown with \"a live API call\", Make fills a module field through an RPC that \"must have the\n * same connection\", n8n's resource locator lists through the node's credentials, and the Activepieces\n * source this catalogue is scraped from declares Asana's workspace as a required dropdown whose options\n * are fetched with the connected account. A connection records only what the vendor REPORTED when it\n * was authorized ({@link ProviderRestOAuth2.accountRefResponsePath}).\n *\n * Declaring an options source does not make the options operation reachable from a browser: it is its\n * own operation, and `providers.browserOperations` must list it like any other.\n *\n * @example\n * // Asana: a task's project is chosen from the projects of the chosen workspace.\n * inputOptions: {\n *   workspace: { operationId: 'list_workspaces', valuePath: 'gid', labelPath: 'name' },\n *   project: { operationId: 'list_projects', valuePath: 'gid', labelPath: 'name', dependsOn: { workspace: 'workspace' } },\n * }\n */\nexport interface ProviderRestOperationInputOptions {\n  /** The operation that lists the choices. Same provider; its output (after its own `resultPath`) must be an array. */\n  readonly operationId: string;\n  /** That operation's catalogue domain, when it differs from the one being called. */\n  readonly domain?: string;\n  /** Dot-path, inside each listed item, to the value the input receives (`gid`). */\n  readonly valuePath: string;\n  /** Dot-path, inside each listed item, to the text a person reads (`name`). Vendor content, never derived from the value. */\n  readonly labelPath: string;\n  /**\n   * Inputs the options depend on: `{ <options-operation input field>: <this operation's input field> }`.\n   * A choice that is not yet made is REFUSED by name rather than listed as empty — \"no projects\" and\n   * \"choose a workspace first\" are different answers, and only one of them is true.\n   */\n  readonly dependsOn?: Readonly<Record<string, string>>;\n}\n\n/**\n * A provider operation, hand-authored. The unit an application addresses:\n * `executeProviderOperation({ providerRef: 'slack', operationId: 'conversations.list', input })`.\n */\nexport interface ProviderRestOperation {\n  /** Unique within the provider, and the address an ETL binding reference uses. */\n  readonly operationId: string;\n  /**\n   * The lazy-load unit. `operations('conversations')` answers only this domain's operations, so a\n   * vendor with hundreds need not evaluate them all to run one.\n   */\n  readonly domain: string;\n  readonly method: API_HttpMethod;\n  /** Relative to the provider's base URL. `{token}` interpolates a PATH parameter of that name. */\n  readonly pathTemplate: string;\n  /**\n   * The API host this operation is served on, when it is not the base URL's host (#2546): an exact lower-case DNS name,\n   * always https. The request is then `https://<host><pathTemplate>`; the base URL's path is not prepended, since it\n   * belongs to the base's host. Absent, which is the norm, the request is `<baseUrl><pathTemplate>`.\n   *\n   * Admitted only where the token the call already carries is valid: the connection's OAuth2 client declares\n   * `audiences`, and the audience that admits the base URL's host admits this host too. So no second token is minted\n   * and no token reaches a host outside its own resource ({@link describeProviderRestOperationHostDefect}). This is\n   * Google's shape: one grant serves every `*.googleapis.com` API, and a Gmail operation names `gmail.googleapis.com`\n   * on the one Google connection. Microsoft's Dataverse is not this shape: its token is a different audience's, so it\n   * stays a provider of its own sharing the connection.\n   */\n  readonly host?: string;\n  readonly summary?: string;\n  /**\n   * Whether the operation MUTATES the vendor.\n   *\n   * ONE vocabulary for every operation catalogue, whatever produced it: a hand-authored operation\n   * and a generated one are the same concept, and two enums over the same two values is precisely\n   * the drift D1 exists to remove. Read by an ETL binding reference (which refuses to serve a read\n   * surface from a WRITE), by the audit trail as the axis a reviewer filters on first, and by a UI\n   * deciding whether to confirm.\n   *\n   * The name carried a source catalogue's spelling until 2026-09-06 and no longer does — an\n   * operation's EFFECT is not a property of where its definition came from.\n   */\n  readonly classification: ExternalOperation_Classification;\n  readonly parameters?: readonly ProviderRestOperationParameter[];\n  readonly requestBody?: ProviderRestOperationRequestBody;\n  /**\n   * Zod schema the caller's input is parsed through BEFORE anything is compiled. A typed client\n   * (S3b) derives its argument type from it. Absent = the input is passed through unvalidated,\n   * which is legal for a thin wrapper and honest about carrying no contract.\n   */\n  readonly inputSchema?: z.ZodType;\n  /**\n   * Zod schema the RESPONSE is parsed through. Absent = the parsed body is returned as `unknown`.\n   * A vendor adding a field must never break a call, so authors should keep these permissive; the\n   * value is in naming the fields a caller may rely on, not in policing the vendor.\n   */\n  readonly outputSchema?: z.ZodType;\n  /**\n   * How the answer is read. Absent = `JSON`, so every operation authored before this field existed\n   * reads exactly as it did.\n   *\n   * It also sets the default `Accept` header — `application/json` for JSON, `*\\/*` otherwise — which a\n   * declared `Accept` HEADER parameter overrides when a vendor needs a specific media type.\n   *\n   * Two combinations are refused by name when the request is compiled, because each describes a payload\n   * that cannot exist: `resultPath` beside `TEXT` or `NONE` (there is no structure to walk), and\n   * `outputSchema` beside `NONE` (there is nothing to parse). `outputSchema` beside `TEXT` is legal and\n   * validates the string.\n   */\n  readonly responseDecoding?: ProviderRestResponseDecoding;\n  /** Required with `responseDecoding: BINARY`, refused with any other decoding (#2910). */\n  readonly binaryResponse?: ProviderRestBinaryResponse;\n  /** Dot-path to the payload inside the response body. Absent = the body IS the payload. JSON answers only. */\n  readonly resultPath?: string;\n  readonly pagination?: ProviderRestOperationPagination;\n  /**\n   * OAuth scopes (or vendor permission names) the credential must carry, as the exact strings the vendor\n   * grants. CHECKED before the request leaves (#979): `ProviderOperationExecutorBackendService` compares them\n   * with the scopes recorded on the spent grant and refuses with the missing ones named when any is absent.\n   * A grant that records no scopes (a pasted key, a vendor that does not echo `scope`) proceeds, and the\n   * call's audit row says the check could not be made — refusing there would break every such vendor.\n   *\n   * Until 2026-09-14 this said \"declared and not checked\"; checking needed the granted set on the grant,\n   * which the connected-accounts lane now stores. Two things not to confuse it\n   * with: `ProviderRestOAuth2.scopes` is the vendor's ADVISORY default set, and the wildo-cli\n   * `getProviderApiKey({ requiredScopes })` parameter is a list of secret-contract SLUGS — a\n   * different concept sharing the name, which no production caller feeds from this field. As of\n   * 2026-09-12 no generated provider declares it either.\n   */\n  readonly requiredScopes?: readonly string[];\n  /**\n   * Whether re-sending this request is safe. Absent = derived from the method: GET, HEAD, OPTIONS,\n   * PUT and DELETE are idempotent, POST and PATCH are not.\n   * spec-cite: RFC 9110 §9.2.2 (PUT, DELETE and the safe methods are idempotent) and §9.2.1\n   * (GET, HEAD, OPTIONS, TRACE are safe).\n   * Declare it TRUE on a POST the vendor documents as idempotent (an idempotency-key endpoint);\n   * declaring it wrongly is how a retried timeout charges a customer twice.\n   */\n  readonly idempotent?: boolean;\n  /** Narrows the provider's semantics for this one operation (a slow export, a tight endpoint). */\n  readonly remoteCallSemantics?: Partial<ProviderRestCallSemantics>;\n  /**\n   * Where each input's choices come from, keyed by INPUT field name. Absent for an input a caller types.\n   * See {@link ProviderRestOperationInputOptions}.\n   */\n  readonly inputOptions?: Readonly<Record<string, ProviderRestOperationInputOptions>>;\n  /** Set when the vendor has deprecated it; the executor logs once per operation, never refuses. */\n  readonly deprecated?: {\n    readonly reason: string;\n    readonly since?: string;\n    readonly replacedByOperationId?: string;\n  };\n}\n\n/** What one `operations(domain?)` call answers. */\nexport interface ProviderRestOperationCatalogue {\n  /** The domains this load carries — the whole set when called with no argument. */\n  readonly domains: readonly string[];\n  /** Keyed by `operationId`. */\n  readonly operations: Readonly<Record<string, ProviderRestOperation>>;\n  /**\n   * Which package contributed an operation that the provider's OWN module does not declare, keyed by\n   * `operationId` (#1672). Absent on every catalogue a provider module loads itself; set only by the\n   * framework when it merges an opted-in AUGMENTATION into a provider it does not own.\n   *\n   * A catalogue value and not a property of the operation, on purpose: an operation declaration is the\n   * augmentation author's data, and a field the author could write would let a package claim to be\n   * somebody else. The merge refuses a loaded catalogue that already carries this field.\n   *\n   * Read by the operation executor, which writes the contributor into the `PROVIDER_OPERATION_CALL` audit\n   * row: a call spending a shared grant must say whose code declared the request it sent.\n   */\n  readonly augmentedBy?: Readonly<Record<string, ProviderRestOperationContributor>>;\n}\n\n/** The package that contributed an operation to a provider it does not own (#1672). */\nexport interface ProviderRestOperationContributor {\n  /** The augmentation package's npm name, as its own manifest states it. */\n  readonly packageName: string;\n  /** The installed version of that package, as `wildo config sync` read it from the manifest. */\n  readonly packageVersion: string;\n}\n\n/**\n * How a vendor states, INSIDE a successful HTTP answer, whether the call it answered succeeded (#2661).\n *\n * Most vendors say it with the status: a 4xx or 5xx is a failure, and the transport already treats it as one. Some\n * answer HTTP 200 for every call they could parse and put the verdict in the body. Slack's Web API is the case:\n * \"All Web API responses contain a JSON object, which will always contain a top-level boolean property `ok` that\n * indicates success or failure\", and \"For failure results, the `error` property will contain a short machine-readable\n * error code\".\n * spec-cite: https://docs.slack.dev/apis/web-api/ — \"Evaluating responses\", fetched 2026-10-06.\n *\n * Without this declaration such an answer reads as a success: `channel_not_found` is returned to the caller as if it\n * were a posted message, the call's audit row says it succeeded, and a revoked token stays \"accepted\" on the\n * credential. Declared on the provider's REST contract (`rest.applicationOutcome`), because the envelope is a fact\n * about the vendor's API, not about one operation.\n *\n * Read for JSON answers only: an operation declaring `TEXT` or `NONE` decoding (a file download) has no envelope.\n */\nexport interface ProviderRestApplicationOutcome {\n  /** Dot-path to the boolean the vendor sets `true` exactly when the call succeeded (Slack: `ok`). */\n  readonly successFlagPath: string;\n  /** Dot-path to the vendor's machine-readable error code on a failed call (Slack: `error`). */\n  readonly errorCodePath: string;\n  /**\n   * The error codes that mean the vendor refused the CREDENTIAL itself, rather than the request: the stored\n   * credential is then recorded as rejected, the way the vendor's answer said (Slack: `invalid_auth`,\n   * `account_inactive`, `token_revoked`, `token_expired`). A code that means the caller sent no credential at all\n   * (Slack's `not_authed`) does not belong here: that is our request's fault, not a dead credential.\n   */\n  readonly credentialRefusedErrorCodes?: readonly string[];\n}\n\n/** What a successful HTTP answer said about the call, read through a {@link ProviderRestApplicationOutcome}. */\nexport enum ProviderRestApplicationOutcomeKind {\n  /** The success flag is `true`. */\n  SUCCEEDED = 'succeeded',\n  /** The success flag is `false`: the vendor refused the call, naming why at the error path when it could. */\n  REFUSED = 'refused',\n  /** The flag is absent or not a boolean: the answer does not carry the envelope its provider declares. */\n  UNSTATED = 'unstated',\n}\n\n/** The verdict a body carries. `errorCode` is kept only when it is a code-shaped string, never prose. */\nexport type ProviderRestApplicationOutcomeVerdict =\n  | { readonly kind: ProviderRestApplicationOutcomeKind.SUCCEEDED }\n  | { readonly kind: ProviderRestApplicationOutcomeKind.REFUSED; readonly errorCode?: string }\n  | { readonly kind: ProviderRestApplicationOutcomeKind.UNSTATED };\n\n/**\n * A vendor error code as the engine may carry it: identifier characters only, at most 128. A value of any other shape\n * is dropped rather than carried, because it travels to audit rows, logs and API answers, and a vendor that puts a\n * sentence (or request data) where a code belongs must not have it repeated there.\n */\nexport const PROVIDER_VENDOR_ERROR_CODE_SHAPE = /^[A-Za-z0-9_.:-]{1,128}$/;\n\n/**\n * The defects of a declared outcome envelope, refused at boot: an empty path, and a credential-refusal code that is not\n * code-shaped, which the transport would never carry and so would never match (#2661 review L7).\n */\nexport function describeProviderRestApplicationOutcomeDefects(outcome: ProviderRestApplicationOutcome): string[] {\n  const defects: string[] = [];\n  const path = /^[A-Za-z0-9_]+(\\.[A-Za-z0-9_]+)*$/;\n  if (!path.test(outcome.successFlagPath)) defects.push(`applicationOutcome.successFlagPath '${outcome.successFlagPath}' is not a dot-path`);\n  if (!path.test(outcome.errorCodePath)) defects.push(`applicationOutcome.errorCodePath '${outcome.errorCodePath}' is not a dot-path`);\n  for (const code of outcome.credentialRefusedErrorCodes ?? []) {\n    if (!PROVIDER_VENDOR_ERROR_CODE_SHAPE.test(code)) {\n      defects.push(`applicationOutcome.credentialRefusedErrorCodes names '${code}', which is not code-shaped and would never match a code the transport keeps`);\n    }\n  }\n  return defects;\n}\n\n/**\n * The placeholder a client-credentials token URL may carry for the tenant the credential belongs to:\n * `https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token`. Filled from the connection's\n * {@link ProviderRestClientCredentials.tenantSecretRef} slot, never from a request.\n */\nexport const PROVIDER_CLIENT_CREDENTIALS_TENANT_PLACEHOLDER = '{tenant}';\n\n/** A tenant value the token URL admits: a GUID or a DNS name. Nothing that can leave the URL's path segment. */\nexport const PROVIDER_CLIENT_CREDENTIALS_TENANT_SHAPE = /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?$/;\n\n/** What a {@link ProviderClientCredentialsVerifiedFact} records: a value the person typed and the vendor accepted. */\nexport enum ProviderClientCredentialsFactSource {\n  /** The client id the token endpoint issued a token for: Microsoft's bot App ID. */\n  CLIENT_ID = 'client_id',\n  /** The tenant whose token endpoint issued it. */\n  TENANT = 'tenant',\n}\n\n/**\n * One fact a client-credentials connection records once the vendor has accepted its credential. See\n * {@link ProviderRestClientCredentials.verifiedAccountFacts}.\n */\nexport interface ProviderClientCredentialsVerifiedFact {\n  readonly source: ProviderClientCredentialsFactSource;\n  /**\n   * `true` when the inbound receiver routes deliveries to an organization by this fact: an organization's own Teams\n   * bot, by its App ID (#2663). Such a fact may name ONE organization only, so a connect whose value another\n   * organization's enabled connection holds is refused, as for a vendor-reported fact.\n   */\n  readonly routesInboundDeliveries?: true;\n  /**\n   * `true` when the vendor treats the value without case, as Microsoft does an App ID or a tenant id (both GUIDs): the\n   * value is recorded LOWER-CASED, so a lookup by the vendor's own spelling (a token's `aud`) finds an id the\n   * administrator typed in capitals (#2663). Never for a value the vendor compares exactly, which most client ids are.\n   */\n  readonly caseInsensitive?: true;\n}\n\n/**\n * A REST provider whose access token is minted with the OAuth 2.0 client-credentials grant, from a client id and\n * secret the connection holds (#2663). The Bot Framework is the first: a Teams bot's App ID and secret, and for a\n * single-tenant bot the tenant it is registered in, mint a token for `https://api.botframework.com/.default`.\n *\n * The token is minted per call when no unexpired one is cached, never stored, and attached where\n * {@link ProviderProtocolRuntimeContract}'s `apiKey` says, so `apiKey.secretRef` names the client SECRET (the slot\n * whose absence means \"not configured\"). The client id, secret and tenant are read from the connection: the\n * application's own environment for an APPLICATION connection, the organization's typed credential for an\n * ORGANIZATION one.\n *\n * The client id and tenant of an ORGANIZATION connection are typed by its administrator, so on their own they prove\n * nothing. They become evidence when the vendor accepts them: at connect the engine mints a token with the typed\n * values, refuses the connection when the vendor refuses, and records each {@link verifiedAccountFacts} entry as\n * `VERIFIED_BY_VENDOR`. A bot App ID then routes deliveries only to the organization that holds its secret.\n *\n * spec-cite: RFC 6749 §4.4 — the client credentials grant (`grant_type=client_credentials`, client authentication,\n * `scope`); Microsoft, \"Authenticate requests with the Bot Connector API\" — the single-tenant token request\n * `POST https://login.microsoftonline.com/MICROSOFT-TENANT-ID/oauth2/v2.0/token` with the scope\n * `https://api.botframework.com/.default`, fetched 2026-10-06.\n */\nexport interface ProviderRestClientCredentials {\n  /** The https token endpoint. May carry {@link PROVIDER_CLIENT_CREDENTIALS_TENANT_PLACEHOLDER}. */\n  readonly tokenUrl: string;\n  /** The hosts the token endpoint may be on once filled. The client secret is sent nowhere else. */\n  readonly tokenHosts: readonly string[];\n  /** The `scope` parameter, sent as written. */\n  readonly scope: string;\n  /** The slot holding the client id. */\n  readonly clientIdSecretRef: string;\n  /** The slot holding the client secret. Equal to the contract's `apiKey.secretRef`. */\n  readonly clientSecretSecretRef: string;\n  /** The slot filling {@link PROVIDER_CLIENT_CREDENTIALS_TENANT_PLACEHOLDER}. Required exactly when the token URL carries it. */\n  readonly tenantSecretRef?: string;\n  /** Facts an ORGANIZATION connection records once the vendor accepted its credential, keyed by fact name. */\n  readonly verifiedAccountFacts?: Readonly<Record<string, ProviderClientCredentialsVerifiedFact>>;\n  /** Seconds a token is kept when the answer states no `expires_in`. Omitted, it is not cached. */\n  readonly tokenLifetimeFallbackSeconds?: number;\n}\n\n/**\n * Why a client-credentials declaration cannot be honoured, or an empty list. Checked where a provider is composed:\n * a token URL that is not https, a token host that is not a DNS name or that the URL is not on, a tenant placeholder\n * with no tenant slot (or the reverse), or any other placeholder in the URL.\n */\nexport function describeProviderRestClientCredentialsDefects(credentials: ProviderRestClientCredentials): string[] {\n  const defects: string[] = [];\n  const hasTenant = credentials.tokenUrl.includes(PROVIDER_CLIENT_CREDENTIALS_TENANT_PLACEHOLDER);\n  const filled = credentials.tokenUrl.split(PROVIDER_CLIENT_CREDENTIALS_TENANT_PLACEHOLDER).join('tenant.example');\n  if (/[{}]/.test(filled)) defects.push(`clientCredentials.tokenUrl '${credentials.tokenUrl}' carries a placeholder other than ${PROVIDER_CLIENT_CREDENTIALS_TENANT_PLACEHOLDER}`);\n  if (hasTenant && credentials.tenantSecretRef === undefined) defects.push(`clientCredentials.tokenUrl carries ${PROVIDER_CLIENT_CREDENTIALS_TENANT_PLACEHOLDER} and no tenantSecretRef fills it`);\n  if (!hasTenant && credentials.tenantSecretRef !== undefined) defects.push(`clientCredentials.tenantSecretRef '${credentials.tenantSecretRef}' fills nothing: the token URL carries no ${PROVIDER_CLIENT_CREDENTIALS_TENANT_PLACEHOLDER}`);\n  const host = /^https:\\/\\/([^/:?#]+)(?::\\d+)?\\//.exec(filled)?.[1]?.toLowerCase();\n  if (host === undefined) defects.push(`clientCredentials.tokenUrl '${credentials.tokenUrl}' is not an https URL with a path`);\n  if (credentials.tokenHosts.length === 0) defects.push('clientCredentials.tokenHosts admits no host');\n  for (const tokenHost of credentials.tokenHosts) {\n    if (!PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(tokenHost.toLowerCase())) defects.push(`clientCredentials.tokenHosts names '${tokenHost}', which is not a DNS name`);\n  }\n  if (host !== undefined && !credentials.tokenHosts.some((tokenHost) => tokenHost.toLowerCase() === host)) {\n    defects.push(`clientCredentials.tokenUrl is on '${host}', which tokenHosts does not admit`);\n  }\n  if (credentials.scope.trim() === '') defects.push('clientCredentials.scope is empty');\n  for (const [name, fact] of Object.entries(credentials.verifiedAccountFacts ?? {})) {\n    if (!/^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(name)) defects.push(`clientCredentials.verifiedAccountFacts names '${name}', which is not a fact name`);\n    if (fact.source === ProviderClientCredentialsFactSource.TENANT && credentials.tenantSecretRef === undefined) {\n      defects.push(`clientCredentials.verifiedAccountFacts '${name}' records the tenant, and no tenantSecretRef holds one`);\n    }\n  }\n  if (credentials.tokenLifetimeFallbackSeconds !== undefined && !(credentials.tokenLifetimeFallbackSeconds > 0)) {\n    defects.push('clientCredentials.tokenLifetimeFallbackSeconds is not a positive number');\n  }\n  return defects;\n}\n\nfunction readDotPath(body: unknown, path: string): unknown {\n  let current: unknown = body;\n  for (const segment of path.split('.')) {\n    if (current === null || typeof current !== 'object' || !Object.hasOwn(current, segment)) return undefined;\n    current = (current as Record<string, unknown>)[segment];\n  }\n  return current;\n}\n\n/**\n * The vendor's error code at `errorCodePath` in a parsed answer, when it is code-shaped. Used for a refused 2xx and for\n * a non-2xx answer alike: a vendor that states its code in the body states it in the same place whatever the status.\n */\nexport function readProviderVendorErrorCode(body: unknown, errorCodePath: string): string | undefined {\n  const code = readDotPath(body, errorCodePath);\n  return typeof code === 'string' && PROVIDER_VENDOR_ERROR_CODE_SHAPE.test(code) ? code : undefined;\n}\n\n/** Reads the verdict a parsed JSON answer carries. The ONE reader: the transport and every test go through it. */\nexport function readProviderRestApplicationOutcome(\n  body: unknown,\n  outcome: Pick<ProviderRestApplicationOutcome, 'successFlagPath' | 'errorCodePath'>,\n): ProviderRestApplicationOutcomeVerdict {\n  const flag = readDotPath(body, outcome.successFlagPath);\n  if (flag === true) return { kind: ProviderRestApplicationOutcomeKind.SUCCEEDED };\n  if (flag !== false) return { kind: ProviderRestApplicationOutcomeKind.UNSTATED };\n  const errorCode = readProviderVendorErrorCode(body, outcome.errorCodePath);\n  return errorCode === undefined\n    ? { kind: ProviderRestApplicationOutcomeKind.REFUSED }\n    : { kind: ProviderRestApplicationOutcomeKind.REFUSED, errorCode };\n}\n/** @wildo_source:part:end external-connectors.models.rest-operation-contract */\n\n/**\n * The lazy catalogue loader — the seam #330's host loader consumes (interface note on #331).\n *\n * MUST NOT be called during composition, discovery or boot: it exists so a provider package can\n * `import()` its own operation module only when a run needs it, and calling it at boot puts every\n * provider's operations back into every process's boot graph, which is the thing on-demand\n * loading exists to remove. Async, idempotent, and memoized by the executor per\n * `(providerRef, domain)` — a loader may assume one call per pair and must stay correct on two.\n *\n * The values it returns carry live Zod schemas, so a catalogue is an IN-PROCESS value and is\n * never serializable into a runtime artifact or any JSON the CLI emits.\n */\nexport type ProviderRestOperationCatalogueLoader = (domain?: string) => Promise<ProviderRestOperationCatalogue>;\n\n/**\n * The QUERY parameters an operation declares under a name its provider places a credential in, compared IGNORING CASE\n * (#2123, #2707). Empty when there is none.\n *\n * Such a parameter asks the caller for the credential the contract already places, so the operation would send the key\n * twice, or send the caller's value instead of the configured one. A name differing only in case travels BESIDE the\n * credential, and a vendor that reads names without regard to case may read the caller's value. Both are a declaration\n * defect.\n *\n * ONE comparison for every place that refuses it, so they cannot drift apart:\n * - the operation executor, once per catalogue load, against the contract's `apiKey.queryParameterName`;\n * - the operation request builder, on every call, against the resolved access's query-placed names (the backstop for a\n *   placement that does not come from the contract);\n * - `wildo` registry module checks, at publish, against the module's own contract.\n *\n * A PATH or HEADER parameter is not compared: a path token is a resource id that may merely be spelled like a\n * credential, and a header credential is refused by its own placement rules.\n */\nexport function providerRestOperationCredentialQueryParameters(\n  operation: Pick<ProviderRestOperation, 'parameters'>,\n  credentialQueryParameterNames: Iterable<string>,\n): string[] {\n  const credentialNames = new Set([...credentialQueryParameterNames].map((name) => name.toLowerCase()));\n  if (credentialNames.size === 0) return [];\n  return (operation.parameters ?? [])\n    .filter((parameter) => parameter.in === ProviderRestParameterLocation.QUERY && credentialNames.has(parameter.name.toLowerCase()))\n    .map((parameter) => parameter.name);\n}\n\n/**\n * Provider-level call semantics: the defaults every operation of this provider runs under.\n *\n * Structurally the executable subset of the ETL's `HttpApiRemoteCallSemantics`, and deliberately\n * NOT that type: the ETL's lives in `@wildo-ai/saas-models/external-data` and carries\n * `maxIdSetSize`, an ETL query-translation bound that means nothing to a provider operation.\n * Importing it here would point the PROVIDER contract at the ETL read surface — backwards, since\n * the ETL references provider operations and not the reverse. Three fields is the price of\n * keeping that arrow pointing the right way.\n */\nexport interface ProviderRestCallSemantics {\n  /** Per-attempt timeout. */\n  readonly timeoutMs: number;\n  readonly retry: {\n    /** Total attempts including the first; 1 disables retry. */\n    readonly maxAttempts: number;\n    /** Linear backoff base — attempt N waits `backoffMs * (N - 1)`. */\n    readonly backoffMs: number;\n  };\n  /**\n   * This REF's share of its connection's allowance: a sliding-window ceiling counted for every call made\n   * through this ref, whichever account it spends (#1729).\n   *\n   * It is a CEILING UNDER the connection's own budgets ({@link ProviderRateBudgetDeclaration}, declared by\n   * the connection's base), never a statement of the vendor's limit: several refs of one shared connection\n   * each keep their own ceiling and all draw on the one vendor allowance together.\n   */\n  readonly maxRequestsPerMinute?: number;\n}\n\n/** @wildo_source:part:start external-connectors.models.connection-rate-budgets facet:layer:shared facet:family:provider facet:audience:app-developer */\n/**\n * WHOSE allowance a vendor counts a request against, under one connection (#1729).\n *\n * A connection is one application registration at the vendor (one OAuth client, one API project) — the\n * base provider's, however many refs spend it. Vendors meter on two axes of it, and a provider declares the\n * one each of its limits uses:\n *\n * | vendor wording | member |\n * |---|---|\n * | Microsoft Graph \"per app across all tenants\"; Google \"per minute per project\" | {@link CONNECTION} |\n * | Google \"per minute per user per project\"; Dataverse \"for each user\"; Graph \"per app per tenant\" / \"per app and mailbox\" when the grant owner IS that tenant or mailbox | {@link OWNER} |\n *\n * spec-cite: https://learn.microsoft.com/en-us/graph/throttling-limits — the global-limits table (\"Per app across all\n * tenants\") and the scope list \"per app across all tenants, per tenant for all apps, per app per tenant\"; and\n * https://developers.google.com/workspace/drive/api/guides/limits — \"per minute per project\" / \"per minute per user per\n * project\". Fetched 2026-09-28.\n *\n * Deliberately NOT a member: \"per tenant for all apps\" (Graph). It counts OTHER applications' calls, which this\n * deployment cannot see, so no local counter can hold it; the vendor's `429` is the only honest signal there.\n */\nexport enum ProviderRateBudgetPartition {\n  /** One allowance for the whole connection — every ref, every account it acts for, every process. */\n  CONNECTION = 'connection',\n  /** One allowance per account the connection acts for — the grant's owner (a person, an organization, the deployment). */\n  OWNER = 'owner',\n}\n\n/**\n * One limit a vendor publishes, as the connection's BASE provider declares it (#1729).\n *\n * Read only from the connection's base: a member ref's declaration is inert, exactly like a member's OAuth client,\n * because the limit belongs to the registration and the base owns the registration. Declared on the REST contract\n * (`rest.rateBudgets`) for a connection whose tokens serve one resource, and on each OAuth2 AUDIENCE\n * (`oauth2.audiences.<id>.rateBudgets`) for a connection spanning several — Microsoft Graph and a Dataverse\n * environment are metered by different services with different numbers, so one list for both would be wrong for one.\n *\n * Counted by the engine BEFORE a request leaves: a call waits for room (bounded, see the executor's\n * `rateBudgetWaitMs`) instead of spending a request the vendor would answer with `429`. The window is SLIDING, which\n * is at least as strict as a vendor's fixed window of the same length.\n */\nexport interface ProviderRateBudgetDeclaration {\n  /** How many requests the window admits. */\n  readonly maxRequests: number;\n  /** The window's length, in seconds, as the vendor states it (Graph's global limit is per 10 s, Dataverse's per 300 s). */\n  readonly windowSeconds: number;\n  /** Whose allowance it is — see {@link ProviderRateBudgetPartition}. */\n  readonly partition: ProviderRateBudgetPartition;\n}\n\n/**\n * Where a budget was COUNTED, as the call that spent it observed (#1729): `shared` when the deployment's shared store\n * (Redis) counted it for every process of the application — backend replicas, minions, workers — and `process` when\n * only this process did, because no shared store is configured here or it did not answer. Recorded on the call's audit\n * row, so a per-process count is visible rather than implied.\n */\nexport enum RateBudgetCounting {\n  SHARED = 'shared',\n  PROCESS = 'process',\n}\n\n/**\n * The defects of a connection's rate-budget declarations: a non-positive number, and a contract-level list beside\n * `oauth2.audiences` — which would apply to nothing, since every call of such a connection is on one audience. A pure\n * function so the registry refuses it at boot and a test pins it without a host.\n */\nexport function describeProviderRateBudgetDefects(input: {\n  readonly contractRateBudgets?: readonly ProviderRateBudgetDeclaration[];\n  readonly audiences?: Readonly<Record<string, { readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[] }>>;\n}): string[] {\n  const defects: string[] = [];\n  const check = (where: string, declarations: readonly ProviderRateBudgetDeclaration[] | undefined): void => {\n    for (const [index, declaration] of (declarations ?? []).entries()) {\n      if (!Number.isInteger(declaration.maxRequests) || declaration.maxRequests < 1) {\n        defects.push(`${where}[${index}].maxRequests must be a positive integer (got ${String(declaration.maxRequests)})`);\n      }\n      if (!Number.isFinite(declaration.windowSeconds) || declaration.windowSeconds <= 0) {\n        defects.push(`${where}[${index}].windowSeconds must be positive (got ${String(declaration.windowSeconds)})`);\n      }\n      if (!Object.values(ProviderRateBudgetPartition).includes(declaration.partition)) {\n        defects.push(`${where}[${index}].partition '${String(declaration.partition)}' is not a ProviderRateBudgetPartition`);\n      }\n    }\n  };\n  check('rest.rateBudgets', input.contractRateBudgets);\n  for (const [id, audience] of Object.entries(input.audiences ?? {})) check(`oauth2.audiences.${id}.rateBudgets`, audience.rateBudgets);\n  if ((input.contractRateBudgets?.length ?? 0) > 0 && Object.keys(input.audiences ?? {}).length > 0) {\n    defects.push('rest.rateBudgets is declared beside oauth2.audiences and would apply to no call — declare each limit on the audience it meters');\n  }\n  return defects;\n}\n\n/**\n * The declarations that apply to one call: the audience's own when the call's token is for an audience, else the\n * contract's. Nothing is inherited between the two — see {@link describeProviderRateBudgetDefects}.\n */\nexport function selectProviderRateBudgetDeclarations(input: {\n  readonly contractRateBudgets?: readonly ProviderRateBudgetDeclaration[];\n  readonly audience?: { readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[] };\n}): readonly ProviderRateBudgetDeclaration[] {\n  return input.audience !== undefined ? input.audience.rateBudgets ?? [] : input.contractRateBudgets ?? [];\n}\n/** @wildo_source:part:end external-connectors.models.connection-rate-budgets */\n\n\n/**\n * A provider whose credential is MINTED by an authorization-code exchange rather than pasted.\n *\n * Recorded because the source catalogues state it and nothing else does. 131 of the 699 transposed\n * vendors declare OAuth2, and their authorize URL, token URL and scopes exist nowhere in this\n * repository except the catalogue that was read — so extracting them and keeping them only in a\n * comment (which is what the transposer did until 2026-09-07) means the delegated-authorization lane\n * re-derives 131 vendors' endpoints by hand.\n *\n * ## What it does NOT change\n *\n * The wire placement. An OAuth2 access token rides in the same header as an API key —\n * `Authorization: Bearer …` — so `apiKey.headerName` and `apiKey.prefix` still describe the request,\n * and `apiKey.secretRef` still names the slot the credential is read from. What this block adds is\n * where that value COMES FROM: an exchange, per organization or per user, refreshable — rather than\n * an operator pasting a long-lived token into an environment variable.\n *\n * That distinction is the whole point. Without it a provider declares a static bearer key and, if an\n * operator happens to paste a long-lived token, WORKS — while advertising a credential model the\n * vendor does not offer, with no authorize step, no refresh and no per-tenant token. A wrong\n * configuration that works is worse than one that fails, because nothing surfaces it.\n *\n * The FLOW is not here and is not implied: connected accounts, the authorization round trip, refresh\n * and revocation are their own lane. This is the declaration that lane consumes.\n */\nexport interface ProviderRestOAuth2 {\n  /** Where the user is sent to grant access. Carries the vendor's own default scopes when it states them. */\n  readonly authorizeUrl: string;\n  /** Where an authorization code (or a refresh token) is exchanged for an access token. */\n  readonly tokenUrl: string;\n  /**\n   * Where a token is handed back to the vendor so the GRANT ends there too (#545).\n   *\n   * Deleting our copy of a token stops US using it. It does not stop the token working, and a\n   * refresh token frequently never expires on its own — so without this, \"Disconnect\" leaves the\n   * application listed in the person's own connected-apps screen at the vendor, and their belief\n   * that they have withdrawn access is not quite true.\n   *\n   * ## Why the field names RFC 7009 rather than \"revocation\"\n   *\n   * The name is the CONTRACT, not decoration. A URL here is POSTed\n   * `application/x-www-form-urlencoded` with a `token` parameter and an optional\n   * `token_type_hint`, and a 200 means the grant is gone — including for a token the server does\n   * not recognise.\n   * spec-cite: RFC 7009 §2.1 (revocation request) and §2.2 (revocation response), fetched\n   * 2026-09-18 — §2.2: *\"The authorization server responds with HTTP status code 200 if the token\n   * has been revoked successfully or if the client submitted an invalid token\"*, and *\"invalid\n   * tokens do not cause an error response since the client cannot handle such an error in a\n   * reasonable way.\"*\n   *\n   * That last sentence is why the caller is best-effort and never branches on the body: there is\n   * nothing to branch on.\n   *\n   * **A vendor whose revocation is NOT RFC 7009 declares nothing here, deliberately.** Slack's\n   * `auth.revoke` is a Web API method and GitHub's is `DELETE /applications/{client_id}/token` with\n   * basic auth and a JSON body; neither is expressible as this URL, and bending the field to fit\n   * them would make a declaration that names RFC 7009 and means something else entirely. Those vendors\n   * need a per-vendor revocation ACTION, which is a bigger surface and is not built on speculation —\n   * until then the honest answer is an absent field, and the disconnect surface says so.\n   *\n   * Absent — not empty — when no revocation is declared, so \"this vendor cannot be told\" stays\n   * distinguishable from \"nobody has looked\".\n   */\n  readonly rfc7009RevocationUrl?: string;\n  /**\n   * Scopes the vendor's own catalogue entry asked for. An application may request FEWER (a subset of\n   * these, once resolved), and an operation's `requiredScopes` is the finer statement. Kept because\n   * it is the only record of what the vendor expects for the operations transposed beside it.\n   *\n   * ## A scope may carry a placeholder, and it is resolved like an endpoint's (#991)\n   *\n   * Two shapes exist, classified by {@link classifyProviderOAuth2ScopePlaceholder}:\n   *\n   * - `{hostUrl}/.default` — the placeholder BEGINS the scope and is followed by `/`, so its value is\n   *   an ORIGIN (Microsoft Dataverse names the resource a token is minted FOR by the environment URL).\n   *   It is filled only within {@link endpointHostAllowances}, exactly like an origin in an endpoint:\n   *   a caller-chosen resource would have the vendor mint a token for a host nobody declared.\n   * - `{permissions}` — the placeholder IS the whole scope entry, and its value is one or more scope\n   *   tokens chosen from {@link scopeValueAllowances}. Such a value can itself name a resource\n   *   (`https://graph.microsoft.com/.default`), so it is a closed choice, never free text.\n   *\n   * Any other placement (`api://{x}`, `{a}{b}`, `{x}.default`) is refused as malformed.\n   */\n  readonly scopes?: readonly string[];\n  /**\n   * How this vendor lets an EXISTING grant grow by one permission (#1671) — declared by the provider module that\n   * owns the OAuth client, never guessed by the engine. See {@link ProviderOAuth2IncrementalConsent}.\n   *\n   * Absent means the vendor's behaviour is not recorded, so a re-authorization for a missing scope RESTATES what the\n   * grant already holds beside the addition: an ordinary authorization that replaces the previous one, which every\n   * RFC 6749 server honours. Declared, the re-authorization asks for the missing scope only and the stored granted\n   * set ACCUMULATES the previous consent with the new answer.\n   */\n  readonly incrementalConsent?: ProviderOAuth2IncrementalConsent;\n  /**\n   * How this vendor is asked for a refresh token, when it is an authorize-request PARAMETER rather than a scope (#2546).\n   * See {@link ProviderOAuth2OfflineAccess}. Absent means the vendor needs no parameter: it issues a refresh token to\n   * every authorization code, or asks for it through a scope the provider lists in `scopes` (Microsoft's\n   * `offline_access`).\n   */\n  readonly offlineAccess?: ProviderOAuth2OfflineAccess;\n  /**\n   * How the token answer's `scope` lists what was granted, when it is not the specification's space-delimited list\n   * (#2546). Absent means RFC 6749's encoding. Read only from the answer; the request is {@link authorizeScopesDelimiter}.\n   */\n  readonly grantedScopesDelimiter?: ProviderOAuth2ScopeListDelimiter;\n  /**\n   * How the AUTHORIZE request's `scope` must list the scopes asked for, when the vendor does not take the specification's\n   * space-delimited list (#2661). Absent means RFC 6749's encoding, which most vendors accept even when their token\n   * answer uses another (GitHub). Slack documents commas for the request: \"a comma-separated list of scopes, such as:\n   * `scope=incoming-webhook,commands`\".\n   * spec-cite: https://docs.slack.dev/authentication/installing-with-oauth — the authorize step, fetched 2026-10-06.\n   */\n  readonly authorizeScopesDelimiter?: ProviderOAuth2ScopeListDelimiter;\n  /**\n   * Whether the vendor accepts PKCE from this application's (confidential) client (#2661). Absent means\n   * {@link ProviderOAuth2PkceSupport.S256}: the authorize request carries an S256 `code_challenge` and the code exchange its\n   * `code_verifier`, which RFC 9700 recommends for every client and every vendor that ignores unknown parameters accepts.\n   *\n   * {@link ProviderOAuth2PkceSupport.NOT_ACCEPTED} is a vendor that REFUSES PKCE unless the application registered as a public\n   * client: Slack answers `pkce_not_allowed` (\"The app is not allowed to use the PKCE flow\"), and turning PKCE on there\n   * is irreversible (\"Enabling PKCE marks your app as a public client, which is is a one-way operation\"), drops the\n   * client secret, and makes every refresh token expire in 30 days. The install then relies on `state`, the exact\n   * `redirect_uri` and the client secret at the exchange, which is what a confidential client has without PKCE.\n   * spec-cite: https://docs.slack.dev/reference/methods/oauth.v2.access — the `pkce_not_allowed` row, and\n   * https://docs.slack.dev/authentication/using-pkce — the quoted sentence, both fetched 2026-10-06.\n   */\n  readonly pkce?: ProviderOAuth2PkceSupport;\n  /**\n   * Scopes a person cannot grant for themselves: only an administrator of the account can (#1671). Microsoft's\n   * application permissions and its admin-restricted delegated permissions are the case — \"Application permissions\n   * always require admin consent\", and a delegated permission that requires admin consent answers a user with \"an\n   * 'unauthorized to consent' error\".\n   * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — \"Admin Consent for\n   * Application permissions\" and \"Admin Consent for Delegated Permissions\", fetched 2026-09-27.\n   *\n   * Never put in a re-authorization request a person is sent to: an operation needing one is refused with the\n   * statement that an administrator must grant it, which is the only thing the person can act on.\n   */\n  readonly administratorConsentScopes?: readonly string[];\n  /**\n   * Env-var names resolving the APPLICATION's registration with the vendor. These are the two values\n   * an operator genuinely does paste — they identify the integration, not the end user — and they\n   * are separate from `apiKey.secretRef`, which names the minted access token.\n   */\n  readonly clientIdSecretRef?: string;\n  readonly clientSecretSecretRef?: string;\n  /**\n   * Placeholders the endpoints above carry, which a CONNECTION must answer before either URL is a\n   * URL at all — `{cloud}`, `{tenantId}`, `{region}`, `{domain}`. A PATH placeholder is answered freely;\n   * a HOST or ORIGIN one only from {@link ProviderRestOAuth2.endpointHostAllowances}.\n   *\n   * Re-measured over the generated catalogue on 2026-09-12: of the 99 vendors that recovered both\n   * endpoints, **20 carry at least one placeholder**, led by `{cloud}` (18 occurrences), `{location}`\n   * (10) and `{tenantId}` (6). Microsoft's authorize URL is\n   * `https://{cloud}/{tenantId}/oauth2/v2.0/authorize`, and no amount of application configuration\n   * supplies those: which Azure cloud and which directory are facts about the ACCOUNT BEING\n   * CONNECTED, known only to the person connecting it.\n   *\n   * So this is not decoration on the endpoint strings — it is the difference between a vendor that\n   * can be connected and one that cannot. Without it the flow would build\n   * `https://{cloud}/…/authorize`, send somebody to a hostname containing a brace, and fail in the\n   * browser rather than at the point where the missing input could have been asked for.\n   *\n   * DERIVED from the endpoint strings rather than authored, so a vendor whose URL gains a\n   * placeholder declares one the next time the batch runs. Absent — not empty — when the endpoints\n   * are plain, which is the common case and must stay distinguishable from \"nobody has looked\".\n   *\n   * Deliberately NOT a judgement about which connections a provider admits. That is a recorded\n   * decision in the catalogue record and is never read from a vendor's API surface; this is a\n   * mechanical fact about a string.\n   *\n   * A placeholder filled from {@link ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_BASE_URL} or\n   * {@link ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_CONFIGURED} is NOT listed: nobody\n   * connecting an account is asked for it, and a value they supply is refused.\n   *\n   * Derived from the {@link scopes} as well as the endpoints (#991): Dataverse's `{hostUrl}/.default`\n   * names a fact about the account (its environment URL) that no endpoint carries, and a placeholder\n   * only a scope mentions was otherwise never asked for — so the authorize request carried the literal\n   * brace to the vendor.\n   */\n  readonly connectionParameters?: readonly string[];\n  /**\n   * How each placeholder that forms an endpoint's HOST or ORIGIN may be filled, keyed by\n   * placeholder name. A host/origin placeholder with NO entry here cannot be filled at all, and the\n   * connect flow refuses it.\n   *\n   * ## Why this exists: the token endpoint receives the application's client secret\n   *\n   * The exchange POSTs `client_id` and the APPLICATION's `client_secret` to the resolved `tokenUrl`.\n   * Until 2026-09-12 every placeholder was answered from the connect-start request body, so where a\n   * placeholder formed the HOST — Microsoft's `https://{cloud}/…/token`, Salesforce's\n   * `https://{environment}/…`, Zoho's `https://accounts.{location}/…` — any user allowed to start a\n   * connection chose where that secret was sent (`cloud=attacker.tld`). Measured over the generated\n   * catalogue that day: 34 host-position occurrences across 17 vendors (9 Microsoft, 6 Zoho,\n   * Salesforce, Workday), plus two whole-origin\n   * placeholders (`gitea`, `bigin-by-zoho`) that were safe only because percent-encoding made them\n   * undialable (#623).\n   *\n   * So a host/origin value is chosen from what the PROVIDER declares, never from what a caller\n   * types. Path and query placeholders (`{tenantId}`, Workday's `{tenant}`) stay free and are\n   * percent-encoded, because an encoded path segment cannot move the request to another host.\n   *\n   * Derived by the transposer where the source catalogue states a closed choice (a dropdown), and\n   * otherwise taken from a recorded human decision in the catalogue record — never guessed.\n   *\n   * Also governs a placeholder that forms the ORIGIN of a SCOPE (`{hostUrl}/.default`, #991). One\n   * allow-list per placeholder name, wherever the name forms a host: a scope's resource URI decides\n   * which host the vendor mints the token for, which is the same question an endpoint's host answers.\n   */\n  readonly endpointHostAllowances?: Readonly<Record<string, ProviderOAuth2EndpointHostAllowance>>;\n  /**\n   * The closed set of values a WHOLE-SCOPE placeholder (`scopes: ['{permissions}']`) may be answered\n   * with, keyed by placeholder name (#991).\n   *\n   * Each value is substituted verbatim as that scope entry and may hold several space-delimited scope\n   * tokens — Microsoft Entra ID's permission presets are one such string each. Matched exactly, because\n   * scope values are case-sensitive.\n   * spec-cite: RFC 6749 §3.3 (the scope parameter is a list of space-delimited, case-sensitive strings).\n   *\n   * Closed rather than free because a scope value can itself name a resource\n   * (`https://graph.microsoft.com/.default`), and a whole-scope placeholder with NO entry here cannot be\n   * answered at all. Derived by the transposer from the source's own dropdown; never guessed.\n   */\n  readonly scopeValueAllowances?: Readonly<Record<string, ProviderOAuth2ScopeValueAllowance>>;\n  /**\n   * Dot-path, inside the TOKEN ENDPOINT'S JSON answer, to the vendor's own identifier for the account\n   * that was just authorized — Slack's `team.id` (#333).\n   *\n   * Read once, at the exchange, into the stored grant's `accountRef`, so a person holding two\n   * connections to one vendor can tell which is which and the grant audit names the account. Absent\n   * means the vendor reports no account identity in its token answer (Asana's names only the user).\n   *\n   * Identity only: nothing looks a credential up by it, and an answer that lacks the path stores the\n   * grant without it — a missing label is not a reason to discard an authorization the person just gave.\n   */\n  readonly accountRefResponsePath?: string;\n  /**\n   * Facts about the connected ACCOUNT that the vendor reports in its token answer and OPERATIONS consume,\n   * keyed by the fact's name (#333, #1047) — Salesforce's `instance_url`, Pipedrive's `api_domain`.\n   *\n   * Captured at the authorization-code exchange and again at every refresh, into the credential row's\n   * `connectionFacts` with provenance `REPORTED_BY_VENDOR`. Distinct from {@link accountRefResponsePath}:\n   * that is a LABEL a person reads, sealed in the grant; these are values requests are built from, kept\n   * client-readable beside the answers a person typed at connect.\n   *\n   * A fact that carries an `origin` allowance is an https ORIGIN operations may dial, so it decides where a\n   * request carrying the credential goes. It is therefore admitted exactly as an ORIGIN placeholder is\n   * ({@link endpointHostAllowances}): refused at connect when absent or outside the allowance, and\n   * re-checked on every call that uses it.\n   */\n  readonly reportedAccountFacts?: Readonly<Record<string, ProviderOAuth2ReportedAccountFact>>;\n  /**\n   * Conditions the ID token of the sign-in that makes a connection must meet (#2663), every one of them, or the\n   * connect is refused before anything is stored. See {@link ProviderOAuth2IdTokenRequirement}. Needs `openid` among\n   * {@link scopes}.\n   */\n  readonly idTokenRequirements?: readonly ProviderOAuth2IdTokenRequirement[];\n  /**\n   * The issuer (`iss`) an ID token this client reads claims from must name (#2663 re-review I1). Required when it reads\n   * any: an {@link idTokenRequirements} entry, or a {@link reportedAccountFacts} fact sourced from ID token claims.\n   *\n   * A claim is used only from a token that names this issuer, names this client as its only audience (`aud`), and has\n   * not expired (`exp`): the checks OpenID Connect requires of a client. A token listing any other audience is refused\n   * too, since a client trusts no audience but itself unless it says so, and nothing here says so. Only the signature\n   * check may be replaced by TLS, which is the one this exchange relies on. A `{claim}` placeholder is filled from the token's own claims, for\n   * an issuer that varies per tenant: Microsoft's multi-tenant `https://login.microsoftonline.com/{tid}/v2.0`.\n   * spec-cite: OpenID Connect Core 1.0 §3.1.3.7, items 2 (\"MUST exactly match the value of the iss (issuer) Claim\"),\n   * 3 (\"MUST validate that the aud (audience) Claim contains its client_id\"; \"The ID Token MUST be rejected if the ID\n   * Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the\n   * Client\"), 6 (TLS in place of the signature) and 9\n   * (\"The current time MUST be before the time represented by the exp Claim\").\n   */\n  readonly idTokenIssuer?: string;\n  /**\n   * The RESOURCE AUDIENCES one grant of this client can mint tokens for, keyed by audience id (#1725), and the\n   * HOSTS a token of each may be sent to.\n   *\n   * ## Why a grant needs more than one access token\n   *\n   * Microsoft issues an access token for ONE resource per request: the token redemption's scopes \"must all be from a\n   * single resource\", and a refresh request spanning several resources returns \"a token for the resource specified\n   * in the first scope\". A refresh token, though, is not tied to a resource: \"A client can use a refresh token to\n   * acquire access tokens across any combination of resource and tenant where it has permission to do so.\" So a\n   * connection spanning Graph and Dataverse keeps ONE refresh token and mints a token per audience from it.\n   * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow — the `scope` rows\n   * of \"Redeem a code for an access token\" and \"Refresh the access token\"; and\n   * https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens — the opening section. Fetched 2026-09-27.\n   *\n   * ## Why the HOSTS are part of the declaration\n   *\n   * An access token is a bearer credential for its resource. Declaring which hosts receive a token of each audience is\n   * what lets the engine attach a token only to a request bound for its own resource (the token-host binding), so an\n   * operation — the base's own, a member's, or an augmentation's (#1672) — can never carry a Graph token to another\n   * host.\n   *\n   * Absent means the provider mints one token for one resource, which is every provider except a connection base that\n   * spans several. When present, {@link primaryAudience} names the audience the AUTHORIZATION grants — the resource of\n   * the connect request's scopes — whose token is the one stored with the grant; every other audience's token is minted\n   * from the refresh token on demand and cached, never stored.\n   */\n  readonly audiences?: Readonly<Record<string, ProviderRestOAuth2Audience>>;\n  /** The audience the authorization itself grants — see {@link audiences}. Required when `audiences` is declared. */\n  readonly primaryAudience?: string;\n  /**\n   * What this vendor's URI scopes NAME (#2546) — see {@link ProviderOAuth2ScopeMeaning}. Read only with `audiences`:\n   * it decides which audience a scope belongs to. Absent means {@link ProviderOAuth2ScopeMeaning.RESOURCE}, Microsoft's\n   * model, where `https://graph.microsoft.com/Mail.Send` is a permission ON the Graph resource.\n   */\n  readonly scopeMeaning?: ProviderOAuth2ScopeMeaning;\n}\n\n/** @wildo_source:part:start external-connectors.models.oauth2-audiences facet:layer:shared facet:family:provider facet:audience:app-developer */\n/** The placeholder a {@link ProviderRestOAuth2Audience.mintScopes} entry uses for the https origin of the request's host. */\nexport const PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER = '{audienceOrigin}';\n\n/** What a vendor's URI scopes name, which decides the audience a scope belongs to — see {@link ProviderRestOAuth2.scopeMeaning}. */\nexport enum ProviderOAuth2ScopeMeaning {\n  /**\n   * A URI scope names the RESOURCE a token is minted for: the scope without its last path segment\n   * (`https://graph.microsoft.com/Mail.Send` is Graph's). Microsoft's model, and the default.\n   */\n  RESOURCE = 'RESOURCE',\n  /**\n   * A URI scope names a PERMISSION of the vendor's one grant, not a resource: Google's scopes are URIs on several hosts\n   * (`https://www.googleapis.com/auth/gmail.readonly`, `https://mail.google.com/`, `https://spreadsheets.google.com/feeds`)\n   * and every one is consented on the same grant, whose one token serves every Google API. So every scope belongs to the\n   * PRIMARY audience, whatever host its URI names. Declared with a single audience only.\n   * spec-cite: https://developers.google.com/identity/protocols/oauth2/scopes — the scope tables, which list both forms\n   * (fetched 2026-10-05).\n   */\n  PERMISSION = 'PERMISSION',\n}\n\n/** One resource audience of a connection's grant. See {@link ProviderRestOAuth2.audiences}. */\nexport interface ProviderRestOAuth2Audience {\n  /**\n   * The hosts a token of this audience may be sent to: exact lower-case hosts, and dotted suffixes admitting\n   * `<dns-labels><suffix>` (never the bare suffix). Every host is https.\n   */\n  readonly hosts: {\n    readonly values: readonly string[];\n    readonly hostSuffixes?: readonly string[];\n  };\n  /**\n   * The scopes that mint a token for this audience, all of ONE resource. An entry may begin with\n   * {@link PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER} — the https origin of the request's own host, admitted by\n   * {@link hosts} first — for a resource named per customer (a Dataverse environment's `<environment-url>/.default`).\n   */\n  readonly mintScopes: readonly string[];\n  /**\n   * The vendor's published limits for THIS resource (#1729) — see {@link ProviderRateBudgetDeclaration}. Per audience\n   * because each resource is metered by its own service: Graph's limits say nothing about a Dataverse environment.\n   */\n  readonly rateBudgets?: readonly ProviderRateBudgetDeclaration[];\n}\n\n/** The audience a request host belongs to, with its id — see {@link selectProviderOAuth2AudienceForHost}. */\nexport interface ProviderOAuth2AudienceSelection {\n  readonly id: string;\n  readonly audience: ProviderRestOAuth2Audience;\n  readonly primary: boolean;\n}\n\n/** Whether `host` is admitted by one audience's hosts: an exact value, or `<labels><suffix>` for a declared suffix. */\nexport function providerOAuth2AudienceAdmitsHost(audience: ProviderRestOAuth2Audience, host: string): boolean {\n  const candidate = host.toLowerCase();\n  if (audience.hosts.values.some((value) => value.toLowerCase() === candidate)) return true;\n  return (audience.hosts.hostSuffixes ?? []).some((suffix) => {\n    const lowered = suffix.toLowerCase();\n    if (!candidate.endsWith(lowered) || candidate.length === lowered.length) return false;\n    return PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(candidate.slice(0, candidate.length - lowered.length));\n  });\n}\n\n/**\n * The ONE audience whose hosts admit `host`, or `undefined` when none does. The declaration guarantees at most one\n * ({@link describeProviderOAuth2AudienceDefects} refuses overlapping hosts), so the answer never depends on order.\n */\nexport function selectProviderOAuth2AudienceForHost(\n  oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience'>,\n  host: string,\n): ProviderOAuth2AudienceSelection | undefined {\n  for (const [id, audience] of Object.entries(oauth2.audiences ?? {})) {\n    if (providerOAuth2AudienceAdmitsHost(audience, host)) return { id, audience, primary: id === oauth2.primaryAudience };\n  }\n  return undefined;\n}\n\n/** Whether `audience` mints its token per request ORIGIN (a mint scope beginning {@link PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER}). */\nexport function providerOAuth2AudienceIsOriginScoped(audience: Pick<ProviderRestOAuth2Audience, 'mintScopes'>): boolean {\n  return audience.mintScopes.some((scope) => scope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER));\n}\n\n/**\n * The scopes that mint `audience`'s token for a request to `origin` — `{audienceOrigin}` replaced by that origin.\n * The caller has already admitted the origin's host through {@link selectProviderOAuth2AudienceForHost}; nothing a\n * caller supplies reaches a scope any other way.\n */\nexport function resolveProviderOAuth2AudienceMintScopes(audience: ProviderRestOAuth2Audience, origin: string): readonly string[] {\n  return audience.mintScopes.map((scope) => (scope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER)\n    ? `${origin}${scope.slice(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER.length)}`\n    : scope));\n}\n\n/**\n * The declared audience a scope a connection might REQUEST names (#1671): its id, or `undefined` when the scope names a\n * resource none of the connection's audiences covers. Only meaningful when `audiences` is declared.\n *\n * A scope that is an absolute URI names the resource a token is minted for (`https://graph.microsoft.com/Mail.Send`,\n * `https://contoso.crm.dynamics.com/user_impersonation`): the resource of one of an audience's fixed mint scopes (the\n * mint scope without its last path segment), or — for a mint scope beginning `{audienceOrigin}` — an https origin whose\n * host the audience admits. A scope that is not an absolute URI (`offline_access`, `Files.Read`) names no resource, and\n * the vendor reads it against its default one, the PRIMARY audience: \"omitting the resource identifier in the `scope`\n * parameter defaults to Microsoft Graph\".\n * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — the note under\n * \"Admin Consent for Delegated Permissions\", fetched 2026-09-27.\n */\nexport function findProviderOAuth2ScopeAudience(\n  oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience' | 'scopeMeaning'>,\n  scope: string,\n): string | undefined {\n  const audiences = oauth2.audiences ?? {};\n  if (!/^[a-z][a-z0-9+.-]*:\\/\\//i.test(scope)) return oauth2.primaryAudience;\n  // A vendor whose scopes name permissions of one grant (Google): every scope is the primary audience's (#2546).\n  if (oauth2.scopeMeaning === ProviderOAuth2ScopeMeaning.PERMISSION) return oauth2.primaryAudience;\n  // The https origin's host, read by the same shape the audiences declare (a DNS name, no port, no credentials) rather\n  // than by a URL parser: this package runs in a browser-neutral program with no URL global, and a scope that is not\n  // that shape names no host an audience could admit.\n  const origin = /^https:\\/\\/([^/?#:@]+)(?:\\/|$)/i.exec(scope);\n  const host = origin?.[1]?.toLowerCase();\n  for (const [id, audience] of Object.entries(audiences)) {\n    for (const mintScope of audience.mintScopes) {\n      if (mintScope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER)) {\n        if (host !== undefined && PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(host) && providerOAuth2AudienceAdmitsHost(audience, host)) return id;\n        continue;\n      }\n      const resource = mintScope.slice(0, mintScope.lastIndexOf('/'));\n      if (resource.length > 0 && scope.startsWith(`${resource}/`)) return id;\n    }\n  }\n  return undefined;\n}\n\n/**\n * Whether a scope a connection might REQUEST names a resource among the connection's declared audiences (#1671) — see\n * {@link findProviderOAuth2ScopeAudience}. Asking a person to consent to it is asking them to let this application reach\n * THAT resource, so a scope from a member ref or an opted-in augmentation (#1672) is requestable only when it names one\n * the connection declares. `true` without looking further when the connection declares no audiences: it mints one token\n * for one resource and its scopes are the vendor's own vocabulary (Google's scope URIs name permissions, not resources).\n */\nexport function providerOAuth2ScopeNamesDeclaredAudience(\n  oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience' | 'scopeMeaning'>,\n  scope: string,\n): boolean {\n  if (oauth2.audiences === undefined) return true;\n  if (!/^[a-z][a-z0-9+.-]*:\\/\\//i.test(scope)) return true;\n  return findProviderOAuth2ScopeAudience(oauth2, scope) !== undefined;\n}\n/**\n * Why an operation's {@link ProviderRestOperation.host} cannot be used on a provider whose REST binding is `contract`, or\n * `undefined` when it can (#2546). The token a call carries is chosen by the base URL's host, so the operation's host\n * must belong to that same audience: then the same token is valid there and nothing is minted for it.\n */\nexport function describeProviderRestOperationHostDefect(\n  host: string,\n  contract: { readonly baseUrl?: string; readonly oauth2?: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience'> },\n): string | undefined {\n  if (host !== host.toLowerCase() || !PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(host)) {\n    return `host '${host}' is not a lower-case DNS name (no scheme, port, path or placeholder)`;\n  }\n  if (contract.oauth2?.audiences === undefined) {\n    return `host '${host}' is declared on a provider whose connection declares no OAuth2 audiences, so its credential is valid only on the base URL's own host`;\n  }\n  // The base URL's https host, read without a URL parser (this package carries no DOM or Node types): the authority up to\n  // the first '/', '?' or '#'. Anything that is not a plain DNS name there (a placeholder, userinfo, a port) has no fixed\n  // audience and is refused.\n  const authority = contract.baseUrl === undefined ? undefined : /^https:\\/\\/([^/?#]*)/i.exec(contract.baseUrl)?.[1]?.toLowerCase();\n  const baseHost = authority !== undefined && PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(authority) ? authority : undefined;\n  if (baseHost === undefined) return `host '${host}' is declared on a provider whose base URL is not one fixed https URL, so the audience its token belongs to is not known`;\n  const baseAudience = selectProviderOAuth2AudienceForHost(contract.oauth2, baseHost);\n  const hostAudience = selectProviderOAuth2AudienceForHost(contract.oauth2, host);\n  if (hostAudience === undefined) return `host '${host}' is admitted by none of the connection's audiences (${Object.keys(contract.oauth2.audiences).join(', ')})`;\n  if (baseAudience?.id !== hostAudience.id) {\n    return `host '${host}' belongs to the audience '${hostAudience.id}', not to '${baseAudience?.id ?? '(none)'}' that the base URL's token is for; an operation on another audience is a provider of its own sharing the connection`;\n  }\n  // An audience whose token is minted per ORIGIN (`{audienceOrigin}/.default`, a Dataverse environment) gives the base\n  // URL's origin its own token, which is not valid on another origin the same audience admits.\n  if (host !== baseHost && providerOAuth2AudienceIsOriginScoped(hostAudience.audience)) {\n    return `host '${host}' is another origin of the audience '${hostAudience.id}', whose token is minted for one origin at a time (the base URL's)`;\n  }\n  return undefined;\n}\n\n/** @wildo_source:part:end external-connectors.models.oauth2-audiences */\n\n/** @wildo_source:part:start external-connectors.models.oauth2-incremental-consent facet:layer:shared facet:family:provider facet:audience:app-developer */\n/**\n * How a vendor extends an existing delegated grant with more scopes — see {@link ProviderRestOAuth2.incrementalConsent}.\n */\nexport enum ProviderOAuth2IncrementalConsentForm {\n  /**\n   * The vendor keeps what the person already consented to, and a new authorization request naming only the added\n   * scopes ADDS them: Microsoft's delegated permissions \"will be granted in addition to any other permissions that\n   * were already granted for that app (i.e. incremental)\".\n   * spec-cite: https://learn.microsoft.com/en-us/entra/identity-platform/consent-types-developer — \"Incremental and\n   * dynamic user consent\", fetched 2026-09-27.\n   */\n  ADDITIVE = 'ADDITIVE',\n  /**\n   * The vendor adds the new scopes to the existing grant only when the request carries `include_granted_scopes=true`:\n   * \"If you set this parameter's value to `true` and the authorization request is granted, then the new access token\n   * will also cover any scopes to which the user previously granted the application access.\"\n   * spec-cite: https://developers.google.com/identity/protocols/oauth2/web-server#incrementalAuth — the\n   * `include_granted_scopes` parameter row, fetched 2026-09-27.\n   */\n  INCLUDE_GRANTED_SCOPES = 'INCLUDE_GRANTED_SCOPES',\n}\n\n/**\n * How a vendor is asked for a refresh token, when a scope does not do it — see {@link ProviderRestOAuth2.offlineAccess}.\n */\nexport enum ProviderOAuth2OfflineAccessForm {\n  /**\n   * Google: the authorize request carries `access_type=offline`, without which no refresh token is issued. The parameter\n   * \"Indicates whether your application can refresh access tokens when the user is not present at the browser. Valid\n   * parameter values are `online`, which is the default value, and `offline`.\"; and \"the refresh token is only returned\n   * if your application set the `access_type` parameter to `offline`\".\n   * spec-cite: https://developers.google.com/identity/protocols/oauth2/web-server — Step 1 (`access_type` row) and\n   * Step 5, fetched 2026-10-05.\n   *\n   * Google issues the refresh token at the FIRST exchange for a consent, so a request that does not grow an existing grant\n   * (a first connect, or a reconnect replacing a grant) also carries `prompt=consent`: a reconnect of an account that had\n   * already consented would otherwise store a grant with no refresh token, which expires within the hour. A request that\n   * grows a grant (`include_granted_scopes`) does not need it, because the stored grant keeps its refresh token.\n   * Decided by practice: the established Google integrations ask for `access_type=offline` with `prompt=consent` for\n   * exactly this reason.\n   */\n  ACCESS_TYPE_OFFLINE = 'ACCESS_TYPE_OFFLINE',\n}\n\n/** Whether a vendor takes PKCE from a confidential client. See {@link ProviderRestOAuth2.pkce}. */\nexport enum ProviderOAuth2PkceSupport {\n  /** An S256 challenge on the authorize request and its verifier on the exchange: the default. */\n  S256 = 'S256',\n  /** The vendor refuses PKCE from a confidential client (Slack): neither is sent. */\n  NOT_ACCEPTED = 'NOT_ACCEPTED',\n}\n\n/**\n * A `scope` list encoding that deviates from RFC 6749's space-delimited list, in either direction: the token answer\n * ({@link ProviderRestOAuth2.grantedScopesDelimiter}) or the authorize request ({@link ProviderRestOAuth2.authorizeScopesDelimiter}).\n * One vocabulary for both, because it is one question (how a vendor writes a list of scopes) asked of two messages.\n */\nexport enum ProviderOAuth2ScopeListDelimiter {\n  /**\n   * GitHub's token answer is `{\"access_token\":\"gho_…\",\"scope\":\"repo,gist\",\"token_type\":\"bearer\"}`, while its authorize\n   * request takes \"A space-delimited list of scopes\". Slack's authorize URL takes \"a comma-separated list of scopes, such\n   * as: `scope=incoming-webhook,commands`\".\n   * spec-cite: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps — step 2's JSON\n   * response example and step 1's `scope` row, fetched 2026-10-05; https://docs.slack.dev/authentication/installing-with-oauth\n   * — the authorize step's `scope` parameter, fetched 2026-10-06.\n   */\n  COMMA = 'COMMA',\n}\n\n/**\n * The granted scopes a token answer's `scope` string names, read with the vendor's declared delimiter: whitespace (RFC\n * 6749 §5.1) when none is declared, a comma for {@link ProviderOAuth2ScopeListDelimiter.COMMA}.\n */\nexport function splitProviderOAuth2GrantedScopes(scope: string, delimiter: ProviderOAuth2ScopeListDelimiter | undefined): string[] {\n  const separator = delimiter === ProviderOAuth2ScopeListDelimiter.COMMA ? /\\s*,\\s*/ : /\\s+/;\n  return scope.split(separator).map((token) => token.trim()).filter((token) => token.length > 0);\n}\n\n/**\n * The authorize request's `scope` value for the scopes asked for, written with the vendor's declared delimiter: a single\n * space (RFC 6749 §3.3) when none is declared, a comma for {@link ProviderOAuth2ScopeListDelimiter.COMMA}.\n * spec-cite: RFC 6749 §3.3 (scope is expressed as a list of space-delimited, case-sensitive strings).\n */\nexport function joinProviderOAuth2RequestedScopes(scopes: readonly string[], delimiter: ProviderOAuth2ScopeListDelimiter | undefined): string {\n  return scopes.join(delimiter === ProviderOAuth2ScopeListDelimiter.COMMA ? ',' : ' ');\n}\n\n/** A vendor's refresh-token request form. See {@link ProviderRestOAuth2.offlineAccess}. */\nexport interface ProviderOAuth2OfflineAccess {\n  readonly form: ProviderOAuth2OfflineAccessForm;\n}\n\n/** A vendor's incremental-consent behaviour. See {@link ProviderRestOAuth2.incrementalConsent}. */\nexport interface ProviderOAuth2IncrementalConsent {\n  readonly form: ProviderOAuth2IncrementalConsentForm;\n  /**\n   * Scopes every re-authorization request repeats beside the added ones — protocol scopes the answer needs rather than\n   * permissions (Microsoft's `offline_access`, without which a code redemption returns no refresh token). Each must be\n   * among the provider's declared {@link ProviderRestOAuth2.scopes}.\n   */\n  readonly restatedScopes?: readonly string[];\n}\n/** @wildo_source:part:end external-connectors.models.oauth2-incremental-consent */\n\n/**\n * Why a declared audience set cannot be honoured, or an empty list. Checked where a provider is composed, so a\n * malformed declaration never reaches a request:\n * - `primaryAudience` names no declared audience, or is missing while audiences are declared;\n * - the primary audience's mint scopes are not among the authorization's own `scopes` (its token is the one the\n *   code redemption returns, so the authorization must be FOR that resource) or use the origin placeholder;\n * - an audience with no host or no mint scope, a suffix without a leading dot, an origin placeholder anywhere but\n *   the start of a scope, or any other `{placeholder}` in a mint scope;\n * - two audiences admitting one host — a request host must select exactly one token.\n */\nexport function describeProviderOAuth2AudienceDefects(oauth2: Pick<ProviderRestOAuth2, 'audiences' | 'primaryAudience' | 'scopes' | 'scopeMeaning'>): string[] {\n  const audiences = oauth2.audiences;\n  if (audiences === undefined) {\n    return oauth2.primaryAudience === undefined ? [] : [`primaryAudience '${oauth2.primaryAudience}' is declared with no audiences`];\n  }\n  // Under PERMISSION every scope is the primary audience's, so a second audience could never be asked for (#2546).\n  if (oauth2.scopeMeaning === ProviderOAuth2ScopeMeaning.PERMISSION && Object.keys(audiences).length > 1) {\n    return [`scopeMeaning PERMISSION reads every scope as the primary audience's, so it is declared with one audience; this declares ${Object.keys(audiences).length}`];\n  }\n  const defects: string[] = [];\n  const primary = oauth2.primaryAudience === undefined ? undefined : audiences[oauth2.primaryAudience];\n  if (primary === undefined) defects.push(`primaryAudience '${String(oauth2.primaryAudience)}' names no declared audience`);\n  for (const [id, audience] of Object.entries(audiences)) {\n    if (audience.hosts.values.length === 0 && (audience.hosts.hostSuffixes ?? []).length === 0) defects.push(`audience '${id}' admits no host`);\n    for (const suffix of audience.hosts.hostSuffixes ?? []) {\n      if (!suffix.startsWith('.') || !PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(suffix.slice(1).toLowerCase())) defects.push(`audience '${id}' declares the host suffix '${suffix}', which is not '.<dns-name>'`);\n    }\n    for (const value of audience.hosts.values) {\n      if (!PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(value.toLowerCase())) defects.push(`audience '${id}' declares the host '${value}', which is not a DNS name`);\n    }\n    if (audience.mintScopes.length === 0) defects.push(`audience '${id}' declares no mint scope`);\n    for (const scope of audience.mintScopes) {\n      const rest = scope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER) ? scope.slice(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER.length) : scope;\n      if (rest.includes('{') || rest.includes('}')) defects.push(`audience '${id}' mint scope '${scope}' carries a placeholder other than a leading ${PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER}`);\n    }\n  }\n  if (primary !== undefined) {\n    for (const scope of primary.mintScopes) {\n      if (scope.startsWith(PROVIDER_OAUTH2_AUDIENCE_ORIGIN_PLACEHOLDER)) defects.push(`the primary audience '${oauth2.primaryAudience}' mint scope '${scope}' names a per-request origin; the authorization must be for one fixed resource`);\n      else if (!(oauth2.scopes ?? []).includes(scope)) defects.push(`the primary audience '${oauth2.primaryAudience}' mint scope '${scope}' is not among the authorization's own scopes`);\n    }\n  }\n  const entries = Object.entries(audiences);\n  for (let left = 0; left < entries.length; left += 1) {\n    for (let right = left + 1; right < entries.length; right += 1) {\n      const [leftId, leftAudience] = entries[left]!;\n      const [rightId, rightAudience] = entries[right]!;\n      const overlap = leftAudience.hosts.values.some((host) => providerOAuth2AudienceAdmitsHost(rightAudience, host))\n        || rightAudience.hosts.values.some((host) => providerOAuth2AudienceAdmitsHost(leftAudience, host))\n        || (leftAudience.hosts.hostSuffixes ?? []).some((suffix) => (rightAudience.hosts.hostSuffixes ?? []).some((other) => suffix.toLowerCase().endsWith(other.toLowerCase()) || other.toLowerCase().endsWith(suffix.toLowerCase())));\n      if (overlap) defects.push(`audiences '${leftId}' and '${rightId}' admit a common host; a request host must select one token`);\n    }\n  }\n  return defects;\n}\n\n/** Where in the token endpoint's answer a {@link ProviderOAuth2ReportedAccountFact} is read. */\nexport enum ProviderOAuth2ReportedFactSource {\n  /** The token endpoint's JSON answer itself: Slack's `team.id`, Salesforce's `instance_url`. The default. */\n  TOKEN_RESPONSE = 'token_response',\n  /**\n   * The claims of the `id_token` that answer carries (OpenID Connect): Microsoft's `tid`, the tenant the person signed\n   * in to. Read without checking the token's signature, which the specification permits for an ID token received\n   * directly from the token endpoint, because TLS has already authenticated who sent it. An answer carrying no\n   * `id_token` reports no such fact. This is how a vendor's account identity becomes VENDOR-REPORTED when its token\n   * answer names the account only inside the ID token (#2660).\n   * spec-cite: OpenID Connect Core 1.0 §3.1.3.7, item 6.\n   */\n  ID_TOKEN_CLAIMS = 'id_token_claims',\n}\n\n/** One vendor-reported account fact. See {@link ProviderRestOAuth2.reportedAccountFacts}. */\nexport interface ProviderOAuth2ReportedAccountFact {\n  /**\n   * Dot-path inside the fact's {@link source}: the token endpoint's JSON answer by default, or the claims of its\n   * `id_token`. A string or finite number there is the value.\n   */\n  readonly responsePath: string;\n  /** Where {@link responsePath} is read. Omitted, the token endpoint's JSON answer. */\n  readonly source?: ProviderOAuth2ReportedFactSource;\n  /**\n   * Present when the value is an https ORIGIN operations dial. The same DECLARED_VALUES vocabulary an\n   * ORIGIN placeholder uses: exact origins, or `https://<dns-labels><suffix>` for each dotted suffix.\n   */\n  readonly origin?: Extract<ProviderOAuth2EndpointHostAllowance, { readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DECLARED_VALUES }>;\n  /**\n   * `true` when the inbound receiver routes the vendor's deliveries to an organization by this fact: Slack's\n   * `team.id`, the workspace an event comes from (#2660). Such a fact may name ONE organization only, so an\n   * organization's connection reporting a value another organization's enabled connection already reports is\n   * refused at connect, naming why. Routing fails closed on a value two organizations hold either way; the refusal is\n   * what makes that a clear answer at connect instead of deliveries that silently route nowhere.\n   */\n  readonly routesInboundDeliveries?: true;\n}\n\n/** What a {@link ProviderOAuth2IdTokenRequirement} asks of the sign-in's ID token claims. */\nexport enum ProviderOAuth2IdTokenRequirementKind {\n  /**\n   * The claim is an array holding at least one of `values`, compared exactly. Microsoft's `wids`, the directory roles\n   * the person holds: a tenant claim requires a role that administers the tenant.\n   */\n  CLAIM_CONTAINS_ANY = 'claim_contains_any',\n  /**\n   * When the claim is present, it equals `equalsClaim`. Microsoft's `idp` against `iss`: they differ for a guest, an\n   * account another tenant authenticated, who speaks for nothing in this one.\n   */\n  CLAIM_EQUALS_CLAIM_WHEN_PRESENT = 'claim_equals_claim_when_present',\n}\n\n/**\n * One condition the ID token of the sign-in that MAKES a connection must meet, or the connect is refused before\n * anything is stored (#2663). For a connection whose reported fact routes deliveries (a Microsoft tenant), proving\n * the account is not enough: the person must also have the authority to bind it to an organization, and the vendor's\n * signed claims are where that authority is stated.\n *\n * Checked at the authorization-code exchange only. A refresh does not re-make the connection, and a vendor need not\n * return an ID token with it; a person whose authority lapsed is caught the next time the connection is made.\n */\nexport type ProviderOAuth2IdTokenRequirement =\n  | { readonly kind: ProviderOAuth2IdTokenRequirementKind.CLAIM_CONTAINS_ANY; readonly claim: string; readonly values: readonly string[] }\n  | { readonly kind: ProviderOAuth2IdTokenRequirementKind.CLAIM_EQUALS_CLAIM_WHEN_PRESENT; readonly claim: string; readonly equalsClaim: string };\n\n/** Why an ID token's claims may not be used (#2663 re-review I1). See {@link providerOAuth2IdTokenRejection}. */\nexport enum ProviderOAuth2IdTokenRejection {\n  /** The token endpoint's answer carries no ID token, or not one whose payload is a JSON object. */\n  ABSENT = 'absent',\n  /** `iss` is not the declared issuer, with its placeholders filled from the token's claims. */\n  ISSUER_MISMATCH = 'issuer_mismatch',\n  /** `aud` does not name this client, or names another audience beside it. */\n  AUDIENCE_MISMATCH = 'audience_mismatch',\n  /** `exp` is missing, or not after the current time. */\n  EXPIRED = 'expired',\n}\n\n/**\n * Why these ID token claims may not be used, or `undefined` when they may: the token names the declared issuer, this\n * client as its only audience, and an expiry still ahead. See {@link ProviderRestOAuth2.idTokenIssuer}.\n *\n * A placeholder of the issuer naming a claim the token does not carry as a non-empty string fails the issuer check:\n * an issuer that cannot be written cannot be matched.\n */\nexport function providerOAuth2IdTokenRejection(\n  claims: Readonly<Record<string, unknown>> | undefined,\n  expected: { readonly issuer: string; readonly clientId: string; readonly nowEpochSeconds: number },\n): ProviderOAuth2IdTokenRejection | undefined {\n  if (claims === undefined) return ProviderOAuth2IdTokenRejection.ABSENT;\n  const claimOf = (name: string): unknown => (Object.hasOwn(claims, name) ? claims[name] : undefined);\n  let unfillable = false;\n  const issuer = expected.issuer.replace(/\\{([^{}]+)\\}/g, (_placeholder, name: string) => {\n    const value = claimOf(name);\n    if (typeof value !== 'string' || value.length === 0) {\n      unfillable = true;\n      return '';\n    }\n    return value;\n  });\n  if (unfillable || claimOf('iss') !== issuer) return ProviderOAuth2IdTokenRejection.ISSUER_MISMATCH;\n  const audience = claimOf('aud');\n  const audiences: readonly unknown[] = Array.isArray(audience) ? audience : [audience];\n  // Every listed audience must be this client: OpenID Connect rejects a token that lists \"additional audiences not\n  // trusted by the Client\", and this client trusts none but itself (no declaration names another).\n  if (audiences.length === 0 || !audiences.every((entry) => entry === expected.clientId)) return ProviderOAuth2IdTokenRejection.AUDIENCE_MISMATCH;\n  const expiry = claimOf('exp');\n  if (typeof expiry !== 'number' || !Number.isFinite(expiry) || expiry <= expected.nowEpochSeconds) return ProviderOAuth2IdTokenRejection.EXPIRED;\n  return undefined;\n}\n\n/** Whether ID token claims meet one requirement. An absent ID token meets none. */\nexport function providerOAuth2IdTokenRequirementHolds(requirement: ProviderOAuth2IdTokenRequirement, claims: Readonly<Record<string, unknown>> | undefined): boolean {\n  if (claims === undefined) return false;\n  const value = Object.hasOwn(claims, requirement.claim) ? claims[requirement.claim] : undefined;\n  switch (requirement.kind) {\n    case ProviderOAuth2IdTokenRequirementKind.CLAIM_CONTAINS_ANY:\n      return Array.isArray(value) && value.some((entry) => typeof entry === 'string' && requirement.values.includes(entry));\n    case ProviderOAuth2IdTokenRequirementKind.CLAIM_EQUALS_CLAIM_WHEN_PRESENT: {\n      if (value === undefined) return true;\n      const other = Object.hasOwn(claims, requirement.equalsClaim) ? claims[requirement.equalsClaim] : undefined;\n      return typeof value === 'string' && value === other;\n    }\n    default: {\n      const unhandled: never = requirement;\n      return unhandled;\n    }\n  }\n}\n\n/**\n * What makes a declaration of ID token requirements unusable: a requirement with no claim or no value, and any\n * requirement on a contract that does not ask for `openid`, without which \"the behavior is entirely unspecified\" and\n * no ID token is returned to read.\n * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 — the `scope` parameter row (\"If the openid scope value is not present,\n * the behavior is entirely unspecified\").\n */\nexport function describeProviderOAuth2IdTokenRequirementDefects(oauth2: Pick<ProviderRestOAuth2, 'idTokenRequirements' | 'scopes' | 'reportedAccountFacts' | 'idTokenIssuer'>): string[] {\n  const requirements = oauth2.idTokenRequirements ?? [];\n  const readsIdTokenFacts = Object.values(oauth2.reportedAccountFacts ?? {}).some((fact) => fact.source === ProviderOAuth2ReportedFactSource.ID_TOKEN_CLAIMS);\n  if (requirements.length === 0 && !readsIdTokenFacts) return [];\n  const defects: string[] = [];\n  if (!(oauth2.scopes ?? []).includes('openid')) defects.push('reads ID token claims without asking for the `openid` scope, so no ID token is returned to read them from');\n  // OpenID Connect Core §3.1.3.7 item 2: a claim is used only from a token naming the expected issuer.\n  if (oauth2.idTokenIssuer === undefined || oauth2.idTokenIssuer.trim().length === 0) {\n    defects.push('reads ID token claims without declaring `idTokenIssuer`, the issuer a token must name before any of its claims is used');\n  } else if (!oauth2.idTokenIssuer.startsWith('https://')) {\n    defects.push(`declares \\`idTokenIssuer\\` ${JSON.stringify(oauth2.idTokenIssuer)}, which is not an https URL as an OpenID issuer identifier is`);\n  }\n  for (const [index, requirement] of requirements.entries()) {\n    if (requirement.claim.trim().length === 0) defects.push(`ID token requirement ${index} names no claim`);\n    if (requirement.kind === ProviderOAuth2IdTokenRequirementKind.CLAIM_CONTAINS_ANY && requirement.values.length === 0) {\n      defects.push(`ID token requirement ${index} (${requirement.claim}) admits no value, so no sign-in could meet it`);\n    }\n    if (requirement.kind === ProviderOAuth2IdTokenRequirementKind.CLAIM_EQUALS_CLAIM_WHEN_PRESENT && requirement.equalsClaim.trim().length === 0) {\n      defects.push(`ID token requirement ${index} (${requirement.claim}) names no claim to equal`);\n    }\n  }\n  return defects;\n}\n\n/** The values a whole-scope placeholder admits. See {@link ProviderRestOAuth2.scopeValueAllowances}. */\nexport interface ProviderOAuth2ScopeValueAllowance {\n  readonly values: readonly string[];\n  /** Values the vendor's source offers and the catalogue declines, matched exactly. See {@link ProviderOAuth2UnsupportedValues}. */\n  readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;\n}\n\n/**\n * Values the vendor's OWN source offers for a placeholder and this catalogue deliberately does NOT admit, each mapped\n * to the reason (#1937). Keyed by the value as the source writes it.\n *\n * Not a second allow-list: the admitted set (`values`, `hosts`) alone decides what is admitted, and a value found\n * here is refused exactly as any other unadmitted value is (`VALUE_NOT_ADMITTED`, which also retires a STORED\n * connection that carries it). What this adds is the WHY. A person who chose, or a connection that stored, a value\n * the catalogue declined is told that it is unsupported and for what reason, instead of being handed a list of other\n * values as though they had made a typing mistake.\n *\n * The first entry is the US Government Microsoft clouds (`login.microsoftonline.us`, GCC High and DoD), declared out\n * of scope by product decision on 2026-09-29. The transposer writes these from the vendor record's declared\n * exclusion (`_code_archive/providers/catalogue-record/vendors/<vendor>.json` since #2019 archived the catalogue; a\n * registry provider adopted from it states them in its own module under `providers-registry/<ref>/`), so reversing a\n * decision is record edits and a regeneration, never an engine change. How many edits depends on what the decline also removed: for the US\n * Government clouds, three (the catalogue README lists them).\n */\nexport type ProviderOAuth2UnsupportedValues = Readonly<Record<string, string>>;\n\n/** How a placeholder's value is compared with a declared one. */\nexport enum ProviderOAuth2ValueComparison {\n  /** A host or an origin: DNS names compare case-insensitively. spec-cite: RFC 4343 §2. */\n  CASE_INSENSITIVE = 'CASE_INSENSITIVE',\n  /** A scope value: scope strings are case-sensitive. spec-cite: RFC 6749 §3.3. */\n  EXACT = 'EXACT',\n}\n\n/**\n * The declared reason a value is unsupported, or `undefined` when it is not declared unsupported. Compared as the\n * placeholder's values are: case-insensitively for a host or origin, exactly for a scope value.\n */\nexport function findProviderOAuth2UnsupportedValueReason(\n  unsupportedValues: ProviderOAuth2UnsupportedValues | undefined,\n  value: string,\n  comparison: ProviderOAuth2ValueComparison,\n): string | undefined {\n  if (unsupportedValues === undefined) return undefined;\n  const key = comparison === ProviderOAuth2ValueComparison.EXACT\n    ? (Object.hasOwn(unsupportedValues, value) ? value : undefined)\n    : Object.keys(unsupportedValues).find((candidate) => candidate.toLowerCase() === value.toLowerCase());\n  return key === undefined ? undefined : unsupportedValues[key];\n}\n\n/**\n * Why a declared unsupported-value map contradicts the admitted set it sits beside, or an empty list: a value both\n * admitted and declined would make the refusal reason a lie, and a declined value with no reason says nothing.\n */\nfunction describeProviderOAuth2UnsupportedValueDefects(\n  unsupportedValues: ProviderOAuth2UnsupportedValues | undefined,\n  admitted: readonly string[],\n  comparison: ProviderOAuth2ValueComparison,\n): readonly string[] {\n  if (unsupportedValues === undefined) return [];\n  const defects: string[] = [];\n  const normalise = (value: string): string => (comparison === ProviderOAuth2ValueComparison.EXACT ? value : value.toLowerCase());\n  const admittedSet = new Set(admitted.map(normalise));\n  for (const [value, reason] of Object.entries(unsupportedValues)) {\n    if (admittedSet.has(normalise(value))) defects.push(`'${value}' is both admitted and declared unsupported`);\n    if (typeof reason !== 'string' || reason.trim() === '') defects.push(`unsupported value '${value}' states no reason`);\n  }\n  return defects;\n}\n\n/**\n * Where a `{placeholder}` sits inside one OAuth2 SCOPE entry. See {@link classifyProviderOAuth2ScopePlaceholder}.\n *\n * Deliberately not {@link ProviderOAuth2EndpointPlaceholderPosition}: a scope is not a URL, and the\n * endpoint scan would call `{permissions}` an ORIGIN (it begins the string and nothing follows it).\n */\nexport enum ProviderOAuth2ScopePlaceholderPosition {\n  /**\n   * The placeholder begins the scope and is followed by `/` — `{hostUrl}/.default`. Its value is an\n   * https ORIGIN, admitted only within {@link ProviderRestOAuth2.endpointHostAllowances}.\n   */\n  ORIGIN = 'ORIGIN',\n  /**\n   * The placeholder is the entire scope entry — `{permissions}`. Its value is one of\n   * {@link ProviderRestOAuth2.scopeValueAllowances}.\n   */\n  WHOLE_SCOPE = 'WHOLE_SCOPE',\n}\n\n/** Why a scope entry cannot be resolved safely, whatever is supplied. See {@link findProviderOAuth2ScopeTemplateDefects}. */\nexport enum ProviderOAuth2ScopeTemplateDefect {\n  /**\n   * A placeholder sits anywhere except at the start of the scope followed by `/` or the end —\n   * `api://{x}/.default`, `{x}.default`, `openid {x}`. Such a value would be concatenated with text\n   * around it into a resource or scope nobody declared.\n   */\n  UNSUPPORTED_PLACEHOLDER_POSITION = 'UNSUPPORTED_PLACEHOLDER_POSITION',\n  /** More than one placeholder in one scope entry: each value validated alone can compose an undeclared one. */\n  SEVERAL_PLACEHOLDERS = 'SEVERAL_PLACEHOLDERS',\n  /** A `{` or `}` that is not part of a well-formed placeholder: a vendor can never grant a scope carrying one. */\n  STRAY_BRACE = 'STRAY_BRACE',\n}\n\n/** One `{placeholder}` in a scope entry. */\nexport interface ProviderOAuth2ScopePlaceholderOccurrence {\n  readonly name: string;\n  readonly position: ProviderOAuth2ScopePlaceholderPosition;\n  /** The whole `{name}` token, for substitution. */\n  readonly token: string;\n}\n\n/**\n * The defects that make a scope entry unsafe to resolve, or an empty list. Shared by the runtime (which\n * refuses) and the transposer (which refuses to emit), so neither admits a shape the other rejects.\n */\nexport function findProviderOAuth2ScopeTemplateDefects(scope: string): readonly ProviderOAuth2ScopeTemplateDefect[] {\n  const occurrences = [...scope.matchAll(PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN)];\n  const withoutPlaceholders = scope.replace(PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN, '');\n  const defects: ProviderOAuth2ScopeTemplateDefect[] = [];\n  if (withoutPlaceholders.includes('{') || withoutPlaceholders.includes('}')) defects.push(ProviderOAuth2ScopeTemplateDefect.STRAY_BRACE);\n  if (occurrences.length > 1) defects.push(ProviderOAuth2ScopeTemplateDefect.SEVERAL_PLACEHOLDERS);\n  const first = occurrences[0];\n  if (first !== undefined) {\n    const next = scope.charAt((first.index ?? 0) + first[0].length);\n    if ((first.index ?? 0) !== 0 || (next !== '' && next !== '/')) defects.push(ProviderOAuth2ScopeTemplateDefect.UNSUPPORTED_PLACEHOLDER_POSITION);\n  }\n  return defects;\n}\n\n/**\n * Classify the one placeholder a scope entry may carry, or `undefined` when it carries none.\n *\n * ONE function, shared by the transposer and the runtime, like its endpoint counterpart. Meaningful only\n * for a scope with no {@link findProviderOAuth2ScopeTemplateDefects}; every consumer refuses those first.\n */\nexport function classifyProviderOAuth2ScopePlaceholder(scope: string): ProviderOAuth2ScopePlaceholderOccurrence | undefined {\n  const match = /^\\{([A-Za-z_][A-Za-z0-9_]*)\\}/.exec(scope);\n  if (match === null) return undefined;\n  return {\n    name: match[1]!,\n    position: match[0].length === scope.length ? ProviderOAuth2ScopePlaceholderPosition.WHOLE_SCOPE : ProviderOAuth2ScopePlaceholderPosition.ORIGIN,\n    token: match[0],\n  };\n}\n\n/**\n * One scope token: printable ASCII except space, `\"` and backslash.\n * spec-cite: RFC 6749 §3.3 (scope-token = 1*( %x21 / %x23-5B / %x5D-7E )).\n * Braces are additionally refused: a value carrying one would read as a placeholder nobody resolves.\n */\nconst PROVIDER_OAUTH2_SCOPE_TOKEN_PATTERN = /^[\\x21\\x23-\\x5B\\x5D-\\x7A\\x7C\\x7E]+$/;\n\n/**\n * Why a declared whole-scope allowance cannot be applied, or an empty list. Enforced at generation so a\n * broken set refuses the batch; the runtime matches exactly and never trusts a value it did not declare.\n */\nexport function describeProviderOAuth2ScopeValueAllowanceDefects(allowance: ProviderOAuth2ScopeValueAllowance): readonly string[] {\n  const defects: string[] = [];\n  if (!Array.isArray(allowance.values) || allowance.values.length === 0) return ['a scope value allowance admits nothing'];\n  for (const value of allowance.values) {\n    const tokens = typeof value === 'string' ? value.split(' ') : [];\n    if (typeof value !== 'string' || value.length === 0 || !tokens.every((token) => PROVIDER_OAUTH2_SCOPE_TOKEN_PATTERN.test(token))) {\n      defects.push(`'${String(value)}' is not a space-delimited list of scope tokens`);\n    }\n  }\n  defects.push(...describeProviderOAuth2UnsupportedValueDefects(allowance.unsupportedValues, allowance.values, ProviderOAuth2ValueComparison.EXACT));\n  return defects;\n}\n\n/**\n * Where a `{placeholder}` sits inside an OAuth2 endpoint template — the classification the host\n * allow-list keys on. See {@link classifyProviderOAuth2EndpointPlaceholders}.\n */\nexport enum ProviderOAuth2EndpointPlaceholderPosition {\n  /**\n   * The placeholder BEGINS the template, so its value is the whole scheme + authority (+ any path\n   * prefix): `{baseUrl}/login/oauth/authorize`. The most dangerous position — the value names the\n   * scheme as well as the host.\n   */\n  ORIGIN = 'ORIGIN',\n  /**\n   * The placeholder sits between `://` and the first `/`, `?` or `#` after it:\n   * `https://{cloud}/common/…`, `https://accounts.{location}/…`. Its value decides which host\n   * receives the request.\n   */\n  HOST = 'HOST',\n  /** Anywhere after the authority. Percent-encoded, so it cannot move the request to another host. */\n  PATH_OR_QUERY = 'PATH_OR_QUERY',\n}\n\n/** How a host- or origin-forming placeholder may be filled. See {@link ProviderRestOAuth2.endpointHostAllowances}. */\nexport enum ProviderOAuth2EndpointHostAllowanceKind {\n  /**\n   * Chosen at connect time from values the provider DECLARES — Microsoft's commercial login cloud,\n   * Zoho's data centres. A value outside the set is refused; a declared value is substituted\n   * verbatim (it is a hostname or origin, not a path segment to encode).\n   *\n   * `hostSuffixes` additionally admits `<dns-label>(.<dns-label>)*` followed by one of the suffixes,\n   * for a vendor whose per-customer host is a subdomain it controls (Salesforce My Domain,\n   * `<name>.my.salesforce.com`). On a HOST placeholder a suffix applies only when the placeholder is\n   * the WHOLE host. On an ORIGIN placeholder it admits exactly `https://<dns-labels><suffix>` — the\n   * scheme fixed to https, no port, path, userinfo, query or fragment — which is what a per-customer\n   * origin such as a Dataverse environment URL (`https://<org>.crm4.dynamics.com`, #991) needs.\n   */\n  DECLARED_VALUES = 'DECLARED_VALUES',\n  /**\n   * Filled from the DEPLOYMENT's configured base URL for this provider — the REST contract's\n   * `baseUrl`, or the environment variable its `baseUrlEnvVarName` names. For a self-hosted vendor\n   * (Gitea) the operator names the instance once; a person connecting an account is never asked, and\n   * a value they supply is refused. Admitted in the ORIGIN position only.\n   */\n  DEPLOYMENT_BASE_URL = 'DEPLOYMENT_BASE_URL',\n  /**\n   * Filled from a deployment environment variable dedicated to THIS placeholder, named by the\n   * allowance's `envVarName` (#992). For a vendor whose endpoints sit on more than one per-tenant host\n   * — Workday's `https://{authHost}/…/authorize` and `https://{apiHost}/…/token` — one base URL cannot\n   * name both, so each host is its own operator setting (`WORKDAY_AUTH_HOST`, `WORKDAY_API_HOST`).\n   *\n   * Like DEPLOYMENT_BASE_URL, never asked of a person connecting, and a value they supply is refused.\n   * The trade is explicit: the application serves the one vendor tenant (data centre) the operator\n   * names. Admitted on a HOST placeholder that is the whole host, with a DNS-name value.\n   */\n  DEPLOYMENT_CONFIGURED = 'DEPLOYMENT_CONFIGURED',\n  /**\n   * DERIVED from another connect-time answer through a declared table (#1937): Microsoft Graph's operation host follows\n   * the login cloud the connection chose (`login.microsoftonline.com` → `graph.microsoft.com`), because a token minted by\n   * one national cloud is not accepted by another. The Microsoft source also maps the US Government login cloud; that\n   * row is declined (`unsupportedValues`), because US Government clouds are out of scope (decision of 2026-09-29).\n   *\n   * Never asked of a person and never taken from a request: the value is looked up from the ANSWER the connection\n   * stored for `answer`, and an answer the table does not name is refused. `whenUnanswered` is the host for a connection\n   * that answered nothing (the application's own pasted credential); absent, such a connection is refused. The table is\n   * the allow-list, so no other host can result. Admitted on a HOST placeholder that is the whole host.\n   *\n   * spec-cite: https://learn.microsoft.com/en-us/graph/deployments — \"Access tokens acquired for a national cloud\n   * deployment are not interchangeable with those acquired for the global service or any other national cloud.\"\n   */\n  DERIVED_FROM_CONNECTION_ANSWER = 'DERIVED_FROM_CONNECTION_ANSWER',\n}\n\nexport type ProviderOAuth2EndpointHostAllowance =\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DECLARED_VALUES;\n    /** Exact admitted values, compared case-insensitively. A hostname for HOST, an origin for ORIGIN. */\n    readonly values: readonly string[];\n    /**\n     * A whole HOST, or an ORIGIN (admitting `https://<labels><suffix>` only). Each MUST begin with `.`,\n     * so `evilmy.salesforce.com` never matches `.my.salesforce.com`.\n     */\n    readonly hostSuffixes?: readonly string[];\n    /**\n     * ORIGIN only: an admitted value must ALSO have the same origin as the deployment's configured base\n     * URL (the REST contract's `baseUrl` / `baseUrlEnvVarName`) (#991 review F4).\n     *\n     * For a vendor whose token is minted for a per-customer environment and whose operations dial the\n     * operator's configured instance — Dataverse mints for the scope's `{hostUrl}` while operations go to\n     * `MICROSOFT_DYNAMICS_CRM_BASE_URL` — a connection naming another environment would hold a token that\n     * fails every call. So the two are required to agree at connect, and an unset base URL refuses the\n     * connect as a deployment gap rather than minting a token nothing can use.\n     */\n    readonly originMatchesDeploymentBaseUrl?: true;\n    /** Values the vendor's source offers and the catalogue declines, with the reason. See {@link ProviderOAuth2UnsupportedValues}. */\n    readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;\n  }\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_CONFIGURED;\n    /**\n     * The deployment environment variable holding the host — derived by the transposer as\n     * `<PROVIDER_ENV_PREFIX>_<PLACEHOLDER_IN_SCREAMING_SNAKE>` and declared as a REGISTRATION secret slot,\n     * without which the runtime environment builder would strip it.\n     */\n    readonly envVarName: string;\n  }\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DERIVED_FROM_CONNECTION_ANSWER;\n    /** The connect-time answer the host is derived from (`cloud`) — itself a placeholder of the same provider. */\n    readonly answer: string;\n    /** Per answer value (compared case-insensitively), the host it selects. DNS names. */\n    readonly hosts: Readonly<Record<string, string>>;\n    /** The host when the connection answered nothing; absent, an unanswered connection is refused. */\n    readonly whenUnanswered?: string;\n    /**\n     * ANSWER values the vendor's source maps to a host and the catalogue declines, with the reason — so a stored\n     * connection carrying one is refused at use naming why. See {@link ProviderOAuth2UnsupportedValues}.\n     */\n    readonly unsupportedValues?: ProviderOAuth2UnsupportedValues;\n  }\n  | {\n    readonly kind: ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_BASE_URL;\n    /**\n     * A path the configured base URL carries and the OAuth2 endpoints do NOT — stripped before\n     * substitution, and REQUIRED to be present. Gitea's operation base is `<instance>/api/v1` while\n     * its OAuth2 endpoints hang off `<instance>`; stripping keeps an instance served under a sub-path\n     * correct, where taking only the origin would drop it.\n     */\n    readonly baseUrlPathSuffix?: string;\n  };\n\n/** One `{placeholder}` occurrence in an OAuth2 endpoint template. */\nexport interface ProviderOAuth2EndpointPlaceholderOccurrence {\n  readonly name: string;\n  readonly position: ProviderOAuth2EndpointPlaceholderPosition;\n  /** Offset of the opening brace in the template. */\n  readonly index: number;\n  /** The whole `{name}` token, for substitution. */\n  readonly token: string;\n  /**\n   * HOST only: the token is the ENTIRE authority (`https://{cloud}/…`), as opposed to one part of it\n   * (`https://accounts.{location}/…`). A declared host SUFFIX is only meaningful for a whole host — on a\n   * partial one it would be concatenated with the text around it and admit a host nobody declared.\n   */\n  readonly occupiesWholeHost: boolean;\n  /**\n   * HOST only: when the token OPENS the authority and is followed by literal text up to the end of the authority —\n   * `https://{subdomain}.zendesk.com/…` → `.zendesk.com` — that literal text (#1015). A declared host SUFFIX equal to it\n   * bounds the composed host exactly as it bounds a whole host: the value is DNS labels, the template's own literal\n   * supplies the suffix, and `<labels>.zendesk.com` is the only shape that can result. Absent for a whole host, for a\n   * token that does not open the host (`accounts.{location}`), and for an ORIGIN or PATH token.\n   */\n  readonly literalHostSuffix?: string;\n}\n\n/**\n * Why an OAuth2 endpoint TEMPLATE cannot be resolved safely, whatever values are supplied.\n * See {@link findProviderOAuth2EndpointTemplateDefects}.\n */\nexport enum ProviderOAuth2EndpointTemplateDefect {\n  /**\n   * The template neither begins `http://` / `https://` nor begins with a placeholder. The WHATWG URL\n   * parser reads `https:/{h}/t`, `https:{h}/t` and `https:` + two backslashes + `{h}/t` as `https://h/t`, so a string scan\n   * for `://` would call `{h}` a PATH placeholder, encode it (a hostname survives encoding untouched),\n   * and send the request — and the client secret — to whatever a caller typed.\n   */\n  NOT_AN_ABSOLUTE_TEMPLATE = 'NOT_AN_ABSOLUTE_TEMPLATE',\n  /**\n   * An ORIGIN placeholder is followed by something other than `/`, `?`, `#` or the end —\n   * `{baseUrl}.evil.test/…`, `{baseUrl}:8443/…`, `{a}{b}/…`. The text after it would extend the host\n   * the origin value names.\n   */\n  ORIGIN_NOT_TERMINATED = 'ORIGIN_NOT_TERMINATED',\n  /**\n   * One authority carries more than one placeholder (`https://{a}{b}/…`, `https://{sub}.{domain}/…`).\n   * Each value validated alone can still compose a host no declaration admits.\n   */\n  SEVERAL_PLACEHOLDERS_IN_AUTHORITY = 'SEVERAL_PLACEHOLDERS_IN_AUTHORITY',\n  /**\n   * The authority after `://` is empty, begins with `/` or a backslash, or carries a backslash or `@`\n   * before the first `/`, `?` or `#`. The parser skips extra slashes (`https:///{h}/t` dials `{h}` as the\n   * HOST, while the `://` scan sees an empty authority and calls `{h}` a PATH), reads a backslash as a\n   * path separator, and\n   * reads text before `@` as userinfo — each makes the scan and the parser disagree about the host.\n   */\n  MALFORMED_AUTHORITY = 'MALFORMED_AUTHORITY',\n}\n\n/**\n * A DNS name: one or more LDH labels, lower-case (callers lower-case first).\n * spec-cite: RFC 1123 §2.1 (a label may begin with a digit) and RFC 1035 §2.3.1 (letters, digits,\n * hyphen; 63 octets per label).\n */\nexport const PROVIDER_OAUTH2_DNS_NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;\n\n/**\n * Why a DECLARED host allowance cannot be applied where its placeholder sits — the position rules the\n * transposer enforces at GENERATION time, so a broken declaration refuses the batch instead of being\n * emitted and refused at every connect. Empty when the allowance is sound.\n *\n * The runtime resolver refuses each of these too; this exists so they are caught where a human is\n * already looking at a diff rather than where a person is pressing Connect.\n */\nexport function describeProviderOAuth2EndpointHostAllowanceDefects(\n  placeholder: { readonly position: ProviderOAuth2EndpointPlaceholderPosition; readonly occupiesWholeHost: boolean; readonly literalHostSuffix?: string },\n  allowance: ProviderOAuth2EndpointHostAllowance,\n): readonly string[] {\n  const defects: string[] = [];\n  if (placeholder.position === ProviderOAuth2EndpointPlaceholderPosition.PATH_OR_QUERY) {\n    return ['a PATH or QUERY placeholder takes no host allowance'];\n  }\n  if (allowance.kind === ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_BASE_URL) {\n    if (placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.ORIGIN) {\n      defects.push('DEPLOYMENT_BASE_URL fills an ORIGIN only, and this placeholder does not begin its endpoint');\n    }\n    if (allowance.baseUrlPathSuffix !== undefined && !/^\\/[^?#]*[^/?#]$/.test(allowance.baseUrlPathSuffix)) {\n      defects.push(`baseUrlPathSuffix '${allowance.baseUrlPathSuffix}' must begin with '/' and name a path (no trailing '/', query or fragment)`);\n    }\n    return defects;\n  }\n  if (allowance.kind === ProviderOAuth2EndpointHostAllowanceKind.DERIVED_FROM_CONNECTION_ANSWER) {\n    if (placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.HOST || !placeholder.occupiesWholeHost) {\n      defects.push('DERIVED_FROM_CONNECTION_ANSWER fills a WHOLE HOST only, and this placeholder is not one');\n    }\n    if (typeof allowance.answer !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(allowance.answer)) {\n      defects.push(`answer '${String(allowance.answer)}' is not a placeholder name`);\n    }\n    const hosts = Object.values(allowance.hosts ?? {});\n    if (hosts.length === 0) defects.push('DERIVED_FROM_CONNECTION_ANSWER maps no answer to a host, which admits nothing');\n    for (const host of [...hosts, ...(allowance.whenUnanswered === undefined ? [] : [allowance.whenUnanswered])]) {\n      if (typeof host !== 'string' || !PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(host.toLowerCase())) defects.push(`'${String(host)}' is not a DNS name`);\n    }\n    defects.push(...describeProviderOAuth2UnsupportedValueDefects(allowance.unsupportedValues, Object.keys(allowance.hosts ?? {}), ProviderOAuth2ValueComparison.CASE_INSENSITIVE));\n    return defects;\n  }\n  if (allowance.kind === ProviderOAuth2EndpointHostAllowanceKind.DEPLOYMENT_CONFIGURED) {\n    if (placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.HOST || !placeholder.occupiesWholeHost) {\n      defects.push('DEPLOYMENT_CONFIGURED fills a WHOLE HOST only, and this placeholder is not one');\n    }\n    if (typeof allowance.envVarName !== 'string' || !/^[A-Z][A-Z0-9_]*$/.test(allowance.envVarName)) {\n      defects.push(`envVarName '${String(allowance.envVarName)}' is not an upper-case environment variable name`);\n    }\n    return defects;\n  }\n  if (allowance.originMatchesDeploymentBaseUrl === true && placeholder.position !== ProviderOAuth2EndpointPlaceholderPosition.ORIGIN) {\n    defects.push('originMatchesDeploymentBaseUrl applies to an ORIGIN only, and this placeholder is not one');\n  }\n  if (allowance.values.length === 0 && (allowance.hostSuffixes ?? []).length === 0) {\n    defects.push('DECLARED_VALUES admits nothing');\n  }\n  for (const value of allowance.values) {\n    if (placeholder.position === ProviderOAuth2EndpointPlaceholderPosition.ORIGIN) {\n      // Matched as text, not with `URL`: this package compiles without a DOM or Node lib. A lower-case\n      // `https://` + DNS name, with nothing after the host but an optional port, is exactly an origin as\n      // `URL#origin` would print it back.\n      const match = /^https:\\/\\/([^:/?#@]+)(?::\\d{1,5})?$/.exec(value);\n      if (match === null || !PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(match[1]!)) {\n        defects.push(`'${value}' is not an https origin (scheme and lower-case host only)`);\n      }\n    } else if (!PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(value.toLowerCase())) {\n      defects.push(`'${value}' is not a DNS name`);\n    }\n  }\n  for (const suffix of allowance.hostSuffixes ?? []) {\n    // An ORIGIN is a whole authority by construction (the scheme is then fixed to https); a HOST\n    // placeholder qualifies only when nothing surrounds it inside the authority.\n    // A placeholder that OPENS the host qualifies too, but only for the ONE suffix the template itself writes after\n    // it (#1015): any other suffix would be concatenated with that literal into a host nobody declared.\n    const opensHostWithThisSuffix = placeholder.literalHostSuffix !== undefined && placeholder.literalHostSuffix.toLowerCase() === suffix.toLowerCase();\n    if (placeholder.position === ProviderOAuth2EndpointPlaceholderPosition.HOST && !placeholder.occupiesWholeHost && !opensHostWithThisSuffix) {\n      defects.push(`host suffix '${suffix}' on a placeholder that is not the whole host`);\n      continue;\n    }\n    const labels = suffix.startsWith('.') ? suffix.slice(1) : '';\n    if (!PROVIDER_OAUTH2_DNS_NAME_PATTERN.test(labels.toLowerCase()) || !labels.includes('.')) {\n      defects.push(`host suffix '${suffix}' must begin with '.' and name at least two DNS labels (a bare '.com' admits every host under a TLD)`);\n    }\n  }\n  defects.push(...describeProviderOAuth2UnsupportedValueDefects(allowance.unsupportedValues, allowance.values, ProviderOAuth2ValueComparison.CASE_INSENSITIVE));\n  for (const declined of Object.keys(allowance.unsupportedValues ?? {})) {\n    // A declined value a declared SUFFIX would still admit is admitted, whatever the reason says.\n    const coveringSuffix = (allowance.hostSuffixes ?? []).find((suffix) => declined.toLowerCase().endsWith(suffix.toLowerCase()));\n    if (coveringSuffix !== undefined) defects.push(`'${declined}' is declared unsupported but the host suffix '${coveringSuffix}' admits it`);\n  }\n  return defects;\n}\n\n/**\n * The defects that make a template unsafe to resolve, or an empty list. Shared by the runtime (which\n * refuses) and the transposer (which refuses to emit), so neither can admit a shape the other rejects.\n */\nexport function findProviderOAuth2EndpointTemplateDefects(template: string): readonly ProviderOAuth2EndpointTemplateDefect[] {\n  const defects: ProviderOAuth2EndpointTemplateDefect[] = [];\n  const leadingPlaceholder = /^\\{[A-Za-z_][A-Za-z0-9_]*\\}/.exec(template);\n  if (!/^https?:\\/\\//i.test(template) && leadingPlaceholder === null) {\n    return [ProviderOAuth2EndpointTemplateDefect.NOT_AN_ABSOLUTE_TEMPLATE];\n  }\n  if (leadingPlaceholder !== null) {\n    const next = template.charAt(leadingPlaceholder[0].length);\n    if (next !== '' && next !== '/' && next !== '?' && next !== '#') defects.push(ProviderOAuth2EndpointTemplateDefect.ORIGIN_NOT_TERMINATED);\n  } else {\n    const afterScheme = template.slice(template.indexOf('://') + 3);\n    const authorityEnd = afterScheme.search(/[/?#]/);\n    const authority = authorityEnd < 0 ? afterScheme : afterScheme.slice(0, authorityEnd);\n    if (authority === '' || authority.includes('\\\\') || authority.includes('@')) {\n      defects.push(ProviderOAuth2EndpointTemplateDefect.MALFORMED_AUTHORITY);\n      return defects;\n    }\n    const hostPlaceholders = classifyProviderOAuth2EndpointPlaceholders(template)\n      .filter((occurrence) => occurrence.position === ProviderOAuth2EndpointPlaceholderPosition.HOST);\n    if (hostPlaceholders.length > 1) defects.push(ProviderOAuth2EndpointTemplateDefect.SEVERAL_PLACEHOLDERS_IN_AUTHORITY);\n  }\n  return defects;\n}\n\n/** The placeholder syntax an endpoint template uses — the same braces the operation path templates use. */\nexport const PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN = /\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g;\n\n/**\n * Classify every placeholder in an OAuth2 endpoint template by the URL component it forms.\n *\n * ONE function, shared by the transposer (which decides which placeholders need an allowance) and\n * the runtime (which refuses an unallowed one), so the two cannot disagree about what a host is.\n *\n * Deliberately a string scan, not a URL parse: a template whose host is still `{cloud}` is not a\n * parseable URL, which is exactly the population this classifies.\n *\n * - offset 0 → {@link ProviderOAuth2EndpointPlaceholderPosition.ORIGIN};\n * - between the first `://` and the next `/`, `?` or `#` → HOST;\n * - otherwise → PATH_OR_QUERY.\n *\n * This classification is only meaningful for a template with no\n * {@link findProviderOAuth2EndpointTemplateDefects}: a template that does not begin `http(s)://` or a\n * placeholder has no authority this scan can find, and every consumer must refuse it FIRST rather than\n * trust the PATH_OR_QUERY answer it would get here.\n */\nexport function classifyProviderOAuth2EndpointPlaceholders(template: string): readonly ProviderOAuth2EndpointPlaceholderOccurrence[] {\n  const schemeSeparator = template.indexOf('://');\n  let authorityEnd = -1;\n  if (schemeSeparator >= 0) {\n    const rest = template.slice(schemeSeparator + 3);\n    const end = rest.search(/[/?#]/);\n    authorityEnd = end < 0 ? template.length : schemeSeparator + 3 + end;\n  }\n  const occurrences: ProviderOAuth2EndpointPlaceholderOccurrence[] = [];\n  for (const match of template.matchAll(PROVIDER_OAUTH2_ENDPOINT_PLACEHOLDER_PATTERN)) {\n    const index = match.index ?? 0;\n    const position = index === 0\n      ? ProviderOAuth2EndpointPlaceholderPosition.ORIGIN\n      : schemeSeparator >= 0 && index > schemeSeparator && index < authorityEnd\n        ? ProviderOAuth2EndpointPlaceholderPosition.HOST\n        : ProviderOAuth2EndpointPlaceholderPosition.PATH_OR_QUERY;\n    const occupiesWholeHost = position === ProviderOAuth2EndpointPlaceholderPosition.HOST\n      && index === schemeSeparator + 3\n      && index + match[0].length === authorityEnd;\n    const followingLiteral = position === ProviderOAuth2EndpointPlaceholderPosition.HOST && !occupiesWholeHost && index === schemeSeparator + 3\n      ? template.slice(index + match[0].length, authorityEnd)\n      : undefined;\n    // Only a PURELY literal remainder qualifies: a second placeholder in the authority is refused as malformed anyway.\n    const literalHostSuffix = followingLiteral !== undefined && followingLiteral.startsWith('.') && !followingLiteral.includes('{') ? followingLiteral : undefined;\n    occurrences.push({ name: match[1]!, position, index, token: match[0], occupiesWholeHost, ...(literalHostSuffix === undefined ? {} : { literalHostSuffix }) });\n  }\n  return occurrences;\n}\n\n\n/**\n * Vendors whose credential is COMPUTED per request rather than sent as a fixed header.\n *\n * A static header covers bearer tokens and API keys, which is most of the world. It cannot express a\n * signature: AWS Signature Version 4 signs the method, the canonical path, the sorted query, a\n * subset of headers, a SHA-256 of the payload and a timestamp, with a key derived from the secret,\n * the date, the region and the service — so the header's VALUE differs for every request and none of\n * its inputs exist when a provider module is authored.\n *\n * Until this existed, such a vendor could not be expressed at all — not badly, not partially. There\n * was no `if` to write, because the field where the answer goes did not exist. 45 transposed actions\n * across `amazon-s3`, `amazon-ses`, `amazon-textract`, `amazon-secrets-manager`, `amazon-sqs`,\n * `amazon-bedrock`, `azure-blob-storage`, `azure-communication-services` and `azure-openai` are\n * blocked on it (#373).\n */\nexport enum ProviderRestSigningScheme {\n  /**\n   * AWS Signature Version 4 — the `Authorization: AWS4-HMAC-SHA256 …` scheme used by every current\n   * AWS service API.\n   * spec-cite: AWS General Reference, \"Signature Version 4 signing process\"\n   * (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv4-signing-process.html)\n   */\n  AWS_SIGV4 = 'AWS_SIGV4',\n  /**\n   * Azure Storage shared-key — `Authorization: SharedKey <account>:<signature>` over a canonicalized\n   * request and resource.\n   * spec-cite: Azure Storage REST, \"Authorize with Shared Key\"\n   * (https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key)\n   */\n  AZURE_SHARED_KEY = 'AZURE_SHARED_KEY',\n}\n\n/**\n * How a provider signs each request.\n *\n * Declared by the provider module and executed by the engine, with NO vendor branch in the executor:\n * the scheme is data, and the signer dispatches on it exhaustively. That is the same discipline the\n * rest of the provider contract keeps — a consumer branches on a contract field, never on a\n * provider ref.\n *\n * The credential is TWO values for both schemes (an identity and a secret), and optionally a third\n * for temporary credentials, which is why it cannot ride in the single `apiKey.secretRef` slot.\n */\nexport interface ProviderRestRequestSigning {\n  readonly scheme: ProviderRestSigningScheme;\n  /** Env-var naming the identity half — an AWS access-key id, an Azure storage account name. */\n  readonly keyIdSecretRef: string;\n  /** Env-var naming the secret half. */\n  readonly secretKeySecretRef: string;\n  /**\n   * Env-var naming a session token, for temporary credentials (STS, a role assumption). Absent means\n   * long-lived credentials; present-but-unset is treated as long-lived rather than as an error,\n   * because the same provider serves both.\n   */\n  readonly sessionTokenSecretRef?: string;\n  /**\n   * AWS_SIGV4: the region and service that scope the derived key. Both are part of the SIGNATURE,\n   * not merely of the URL, so a wrong value fails authentication rather than routing — which is why\n   * they are declared rather than parsed out of the host.\n   */\n  readonly region?: string;\n  readonly service?: string;\n  /**\n   * Env-var overriding {@link region} per deployment, for an application that runs in more than one.\n   * The declared value is the default.\n   */\n  readonly regionEnvVarName?: string;\n}\n\n/**\n * The one function a generated typed client needs, as a TYPE.\n *\n * A generated provider package must not import the engine's runtime to be callable: that would put\n * the whole backend into the module graph of anything that touches a vendor, which is precisely the\n * weight #378 removed (models 20.8 MB against the backend barrel's 160.7 MB). So a client is a\n * FACTORY that takes the executor as an argument — the application wires its own, the package\n * declares only this signature, and nothing crosses at runtime.\n *\n * R3's ergonomics bought with a type rather than a dependency.\n *\n * ## The connection is a parameter, and OPTIONAL for a reason that is not convenience\n *\n * Omitted means the application's own account, acting as itself — the floor, and the only connection\n * that needs no store and no authorization. That default is what keeps the ordinary single-account\n * call as short as it should be.\n *\n * It could not be anything BUT a parameter. One execution may legitimately spend several tenants'\n * accounts — a user action pushing a message to every organization that user belongs to — so a client\n * that read the owner from ambient state could not vary it per call, and the fan-out would be\n * inexpressible through the generated surface even though the engine beneath it supports one.\n */\nexport type ProviderOperationExecute = (\n  providerRef: string,\n  operationId: string,\n  input: Readonly<Record<string, unknown>>,\n  connection?: ExternalProvider_ConnectionTarget,\n) => Promise<unknown>;\n"]}