@wildo-ai/saas-backend-lib 1.0.1

package/src/errors/services/error-handler.backend.service.ts

@@ -0,0 +1,236 @@
+import { NextFunction, Request, Response } from 'express';
+import { inject, injectable } from 'inversify';
+import { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';
+import { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';
+import { ErrorBuilderBackendService } from './error-builder.backend.service';
+
+// Import the unified error system
+import {
+  ErrorResponse,
+  ErrorType,
+  ExecutionContext_InitiatorIds,
+  WildoError_Backend,
+  ValidationErrors,
+  ValidationErrorEntry,
+  WildoHeaderKeys,
+} from '@wildo-ai/saas-models';
+import { ExecutionContext, } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';
+
+
+/**
+ * Unified Error Handler Service
+ * Handles all errors using the new unified error management system
+ */
+@injectable()
+export class ErrorHandlerService {
+  protected logDebug: (message: string, context?: Record<string, unknown>) => void;
+
+  constructor(
+    @inject(SAAS_SERVICE_TYPES.Logger) private logger: LoggerService,
+    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private errorBuilder: ErrorBuilderBackendService
+  ) {
+    this.logDebug = this.logger.debugByType('ErrorHandlerService');
+    this.logger.setDebugTypeLogging('ErrorHandlerService', false);
+  }
+
+  /**
+   * Express error handling middleware with unified error system
+   * Express requires exactly 4 parameters: (err, req, res, next)
+   */
+  expressErrorHandler(): (error: Error|WildoError_Backend, req: Request, res: Response, next: NextFunction) => void {
+    return (error: Error|WildoError_Backend, req: Request, res: Response, next: NextFunction): void => {
+      // Check if response has already been sent
+      if (res.headersSent) {
+        // If headers are already sent, delegate to Express default handler
+        return next(error);
+      }
+
+      // Extract executionContext from request if available
+      const executionContext = (req as any).executionContext as ExecutionContext<any> | undefined;
+
+      const errorToHandle = error instanceof Error
+        ? this.errorBuilder.buildFromStandardError(error, executionContext)
+        : error;
+      errorToHandle.ipAddress = this.getClientIpAddress(req);
+
+      this.sendErrorResponse(errorToHandle, res);
+    };
+  }
+
+  handleBatchesCronjobsError(error: Error|WildoError_Backend, executionContext?: ExecutionContext<any>): void {
+    const errorToHandle = error instanceof Error ? this.errorBuilder.buildFromStandardError(error, executionContext) : error;
+
+    this.logger.error('Batch/cronjob execution failed', {
+      errorType: errorToHandle.type,
+      severity: errorToHandle.severity,
+      message: errorToHandle.customMessageReference,
+      statusCode: errorToHandle.statusCode,
+      operationPath: errorToHandle.operationPathKey,
+      ...(errorToHandle.context && { context: errorToHandle.context }),
+      ...(errorToHandle.stack && { stack: errorToHandle.stack }),
+    });
+  }
+
+
+  private sendErrorResponse(saasError: WildoError_Backend, res: Response, initiatorIds?: ExecutionContext_InitiatorIds): void {
+    // Double-check if headers are already sent
+    if (res.headersSent) {
+      this.logger.warn('Cannot send error response - headers already sent', {
+        errorType: saasError.type,
+        statusCode: saasError.statusCode
+      });
+      return;
+    }
+
+    try {
+      // Build validationErrors for responses that carry field-level error information.
+      // Values can be plain strings (Zod errors) or structured ValidationErrorEntry objects (unique constraints).
+      //
+      // C3: Intentional extraction order — validationErrors are extracted from the raw error
+      // BEFORE sanitizeErrorForClient() runs. This is by design: zodIssues contain field-level
+      // validation messages that must appear in the response for form UX, even though the
+      // sanitization layer may strip them from `details`. If zodIssues are removed from the
+      // sanitization allowlist in the future, validationErrors will still be included because
+      // they are extracted independently above the sanitization call.
+      let validationErrors: ValidationErrors | undefined;
+
+      // CONFLICT (409): Unique constraint violations — use structured i18n entries
+      if (saasError.type === ErrorType.CONFLICT && saasError.context?.fieldName) {
+        const fieldName = saasError.context.fieldName as string;
+        const duplicateValue = saasError.context.duplicateValue as string | undefined;
+        const customErrorMessage = saasError.context.customErrorMessage as string | undefined;
+        const fallbackMessage = customErrorMessage
+          ? customErrorMessage.replace('{fieldName}', fieldName)
+          : duplicateValue
+            ? `"${duplicateValue}" already exists`
+            : 'Value already exists';
+
+        const entry: ValidationErrorEntry = {
+          key: 'validation.unique.conflict',
+          message: fallbackMessage,
+          params: {
+            fieldName,
+            ...(duplicateValue ? { value: duplicateValue } : {}),
+          },
+        };
+        validationErrors = { [fieldName]: entry };
+      }
+
+      // VALIDATION (400): Zod validation errors — plain strings (already localized by Zod)
+      if (saasError.type === ErrorType.VALIDATION && saasError.context?.zodIssues) {
+        const zodIssues = saasError.context.zodIssues as Array<{ path: (string | number)[]; message: string }>;
+        validationErrors = zodIssues.reduce((acc, issue) => {
+          const fieldPath = issue.path.join('.');
+          acc[fieldPath] = issue.message;
+          return acc;
+        }, {} as ValidationErrors);
+      }
+
+      // H9 fix: Sanitize error at serialization boundary — backend logs retain full context,
+      // but the HTTP response strips internal details (emails, stack traces, session IDs, etc.)
+      const sanitizedError = this.errorBuilder.sanitizeErrorForClient(saasError);
+
+      const response: ErrorResponse = {
+        error: {
+          type: saasError.type,
+          severity: saasError.severity,
+          message: saasError.customMessageReference,
+          customMessage: saasError.customMessageReference,
+          ...(saasError.customMessageReference && { customMessageReference: saasError.customMessageReference }),
+          operationPath: saasError.operationPathKey,
+          timestamp: saasError.timestamp.toISOString(),
+          initiatorIds: saasError.initiatorIds,
+          // executionType: saasError.executionType,
+          // stack: saasError.stack,
+          ...(sanitizedError.context && { details: sanitizedError.context }),
+          // FIX-P6-H1: Include validationErrors at top level for frontend parsing
+          ...(validationErrors && { validationErrors }),
+          // Phase 1b: Include user guidance if present on the error
+          ...(saasError.userGuidance && { userGuidance: saasError.userGuidance }),
+        }
+      };
+
+      res.status(saasError.statusCode).json(response);
+    } catch (sendError) {
+      // If sending the error response fails, log it but don't throw
+      // This prevents Express default HTML error handler from being triggered
+      this.logger.error('Failed to send error response', {
+        originalError: saasError.type,
+        sendError: sendError instanceof Error ? sendError.message : String(sendError)
+      });
+    }
+  }
+
+
+  /**
+   * Get client IP address
+   */
+  private getClientIpAddress(req: Request): string {
+    const xForwardedFor = req.headers[WildoHeaderKeys.FORWARDED_FOR];
+    if (xForwardedFor) {
+      return Array.isArray(xForwardedFor) ? xForwardedFor[0] : xForwardedFor.split(',')[0];
+    }
+
+    return req.headers[WildoHeaderKeys.REAL_IP] as string ||
+           req.connection?.remoteAddress ||
+           req.socket?.remoteAddress ||
+           'unknown';
+  }
+
+  /**
+   * Create async error wrapper for route handlers
+   */
+  asyncHandler(fn: Function): (req: Request, res: Response, next: NextFunction) => void {
+    return (req: Request, res: Response, next: NextFunction): void => {
+      Promise.resolve(fn(req, res, next)).catch(next);
+    };
+  }
+
+  /**
+   * Global unhandled rejection handler
+   */
+  handleUnhandledRejection(): void {
+    process.on('unhandledRejection', (reason: any, promise: Promise<any>) => {
+      const errorToHandle = this.errorBuilder.buildError(ErrorType.UNHANDLED_REJECTION, undefined, {
+        stack: reason?.stack,
+        context: {
+          name: reason?.name,
+          message: reason?.message,
+          promise: promise.toString()
+        }
+      });
+      this.logger.fatal('Unhandled Promise Rejection', { ...errorToHandle });
+
+      // Graceful shutdown
+      process.exit(1);
+    });
+  }
+
+  /**
+   * Global uncaught exception handler
+   */
+  handleUncaughtException(): void {
+    process.on('uncaughtException', (error: Error) => {
+      const errorToHandle = this.errorBuilder.buildError(ErrorType.UNCAUGHT_EXCEPTION, undefined, {
+        stack: error.stack,
+        context: {
+          name: error.name,
+          message: error.message,
+        }
+      });
+      this.logger.fatal('Uncaught Exception', { ...errorToHandle });
+
+      // Graceful shutdown
+      process.exit(1);
+    });
+  }
+
+  /**
+   * Initialize global error handlers
+   */
+  initializeGlobalHandlers(): void {
+    this.handleUnhandledRejection();
+    this.handleUncaughtException();
+  }
+
+}

package/src/errors/services/rate-limit.backend.service.ts

@@ -0,0 +1,45 @@
+/**
+ * Rate Limit Backend Service — CORE-9
+ *
+ * Single source of truth for controller-level rate limit checks.
+ * Uses Redis INCR+EXPIRE via RedisService; throws RATE_LIMIT error when exceeded.
+ */
+
+import 'reflect-metadata';
+import { injectable, inject } from 'inversify';
+import { ErrorType } from '@wildo-ai/saas-models';
+import { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';
+import { RedisService } from '~wildo-backend-lib/databases/services/redis.service';
+import { ErrorBuilderBackendService } from './error-builder.backend.service';
+
+@injectable()
+export class RateLimitBackendService {
+  constructor(
+    @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,
+    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,
+  ) {}
+
+  /**
+   * Check rate limit: increment count, throw if exceeded.
+   * @param key — identifier (e.g. `auth:reset:email:${email}`)
+   * @param maxRequests — max allowed in window
+   * @param windowSeconds — window duration in seconds
+   * @param organizationId — optional tenant scope
+   */
+  public async checkRateLimit(
+    key: string,
+    maxRequests: number,
+    windowSeconds: number,
+    organizationId?: string,
+  ): Promise<void> {
+    const count = await this.redisService.incrementRateLimit(key, windowSeconds, organizationId);
+    if (count > maxRequests) {
+      throw this.errorBuilder.buildError(ErrorType.RATE_LIMIT, undefined, {
+        context: {
+          message: 'Too many requests. Please try again later.',
+          retryAfterSeconds: windowSeconds,
+        },
+      });
+    }
+  }
+}

package/src/external-providers/models/external-providers.backend.schemas.ts

@@ -0,0 +1,243 @@
+/**
+ * Backend-Only External Provider OAuth2 Configuration
+ * 
+ * This module extends the OAuth2 definitions from external-connectors-models
+ * with backend-specific fields (secrets, endpoints, etc.)
+ * 
+ * ARCHITECTURE:
+ * - Public OAuth2 configuration: @wildo-ai/external-connectors-models (shared)
+ * - Backend OAuth2 configuration: This file (backend-only secrets and endpoints)
+ * 
+ * IMPORTANT: Reuses schemas from external-connectors-models, does NOT redefine them
+ */
+
+import { z } from "zod";
+import { RateLimitConfigurationSchema, RateLimitConfiguration } from "@wildo-ai/saas-models";
+import { 
+  OAuth2Provider_ConfigurationSchema, 
+  OAuth2Provider_Configuration,
+  OAuth2_EndpointsSchema,
+  OAuth2_Endpoints,
+  OAuth2_TokenConfigSchema,
+  OAuth2_TokenConfig,
+  OAuth2_ProviderCapabilitiesSchema,
+  OAuth2_ProviderCapabilities,
+  OAuth2_GrantType,
+  OAuth2_TokenEndpoint_AuthMethod,
+  OAuth2_PKCE_Method,
+} from "@wildo-ai/external-connectors-models";
+
+// =============================================================================
+// BACKEND-ONLY OAUTH2 CREDENTIALS
+// =============================================================================
+
+/**
+ * OAuth2 Client Credentials (Backend-only secrets)
+ * These should NEVER be exposed to frontend
+ */
+export const OAuth2_BackendCredentialsSchema = z.object({
+  /** OAuth2 Client ID */
+  clientId: z.string().min(1, { message: 'Client ID is required' }),
+  
+  /** OAuth2 Client Secret - SENSITIVE */
+  clientSecret: z.string().min(1, { message: 'Client secret is required' }),
+  
+  /** Service Account Email (for S2S auth like Google) */
+  serviceAccountEmail: z.email().optional(),
+  
+  /** Service Account Key (JSON key or path) - SENSITIVE */
+  serviceAccountKey: z.string().optional(),
+  
+  /** Private key for JWT Bearer assertions - SENSITIVE */
+  privateKeyPem: z.string().optional(),
+  
+  /** Key ID for JWT Bearer assertions */
+  keyId: z.string().optional(),
+});
+export type OAuth2_BackendCredentials = z.infer<typeof OAuth2_BackendCredentialsSchema>;
+
+// =============================================================================
+// BACKEND-ONLY OAUTH2 ENDPOINTS (extends shared endpoints)
+// =============================================================================
+
+/**
+ * Backend OAuth2 Endpoints
+ * Extends the shared endpoints with backend-specific URLs
+ */
+export const OAuth2_BackendEndpointsSchema = OAuth2_EndpointsSchema.extend({
+  /** UserInfo endpoint (required for backend to fetch user profile) */
+  userInfoUrl: z.url({ message: 'Valid userinfo endpoint required' }),
+  
+  /** Token endpoint (required for backend token exchange) */
+  tokenUrl: z.url({ message: 'Valid token endpoint required' }),
+});
+export type OAuth2_BackendEndpoints = z.infer<typeof OAuth2_BackendEndpointsSchema>;
+
+// =============================================================================
+// INTEGRATION CONFIGURATION
+// =============================================================================
+
+/**
+ * OAuth2 Integration Configuration
+ * Defines how to access different integrations through this OAuth2 provider
+ */
+export const OAuth2_IntegrationConfigSchema = z.object({
+  /** Scopes required for each integration */
+  scopes: z.record(
+    z.string(), // integration name (e.g., 'drive', 'calendar')
+    z.array(z.string()) // required scopes
+  ).default({}),
+  
+  /** API endpoints for each integration */
+  endpoints: z.record(
+    z.string(), // integration name
+    z.object({
+      baseUrl: z.url(),
+      version: z.string().optional(),
+      authHeader: z.string().optional(), // Authorization header format
+    })
+  ).default({}),
+});
+export type OAuth2_IntegrationConfig = z.infer<typeof OAuth2_IntegrationConfigSchema>;
+
+// =============================================================================
+// TOKEN MANAGEMENT CONFIGURATION
+// =============================================================================
+
+/**
+ * Backend Token Management Configuration
+ * Extends shared token config with backend-specific settings
+ */
+export const OAuth2_BackendTokenConfigSchema = OAuth2_TokenConfigSchema.extend({
+  /** How many seconds before expiry to refresh the token */
+  refreshBeforeExpirySeconds: z.number().nonnegative().default(300),
+  
+  /** Maximum retry attempts for token refresh */
+  refreshRetryAttempts: z.number().nonnegative().default(3),
+  
+  /** Retry delay in milliseconds */
+  refreshRetryDelayMs: z.number().nonnegative().default(1000),
+});
+export type OAuth2_BackendTokenConfig = z.infer<typeof OAuth2_BackendTokenConfigSchema>;
+
+// =============================================================================
+// PKCE CONFIGURATION
+// =============================================================================
+
+/**
+ * PKCE Configuration for OAuth2
+ * Reuses PKCE method enum from external-connectors-models
+ */
+export const OAuth2_PKCEConfigSchema = z.object({
+  /** Enable PKCE */
+  enabled: z.boolean().default(true),
+  
+  /** PKCE code challenge method (S256 recommended) */
+  codeChallengeMethod: z.enum(OAuth2_PKCE_Method).default(OAuth2_PKCE_Method.S256),
+});
+export type OAuth2_PKCEConfig = z.infer<typeof OAuth2_PKCEConfigSchema>;
+
+// =============================================================================
+// COMPLETE BACKEND OAUTH2 CONFIGURATION
+// =============================================================================
+
+/**
+ * Complete Backend OAuth2 Provider Configuration
+ * 
+ * Extends OAuth2Provider_ConfigurationSchema from external-connectors-models
+ * with backend-only fields (credentials, endpoints, etc.)
+ * 
+ * This is the full configuration needed by the backend to:
+ * 1. Initiate OAuth2 flows
+ * 2. Exchange authorization codes for tokens
+ * 3. Refresh tokens
+ * 4. Make authenticated API calls to integrations
+ */
+export interface ExternalProvider_OAuth2_BackendConfiguration extends OAuth2Provider_Configuration {
+  // Credentials (backend-only)
+  credentials: OAuth2_BackendCredentials;
+  
+  // Backend endpoints (extends shared endpoints)
+  backendEndpoints: OAuth2_BackendEndpoints;
+  
+  // Integration configuration
+  integrations: OAuth2_IntegrationConfig;
+  
+  // Token management
+  tokenManagement: OAuth2_BackendTokenConfig;
+  
+  // PKCE configuration
+  pkce: OAuth2_PKCEConfig;
+  
+  // Rate limits for API calls
+  rateLimits: RateLimitConfiguration;
+  
+  // Provider capabilities (from external-connectors-models)
+  capabilities?: OAuth2_ProviderCapabilities;
+}
+
+/**
+ * Backend OAuth2 Configuration Schema
+ * 
+ * Uses composition pattern to extend the shared OAuth2Provider_ConfigurationSchema
+ */
+export const ExternalProvider_OAuth2_BackendConfigurationSchema: z.ZodType<ExternalProvider_OAuth2_BackendConfiguration> = OAuth2Provider_ConfigurationSchema.extend({
+  // ─── Backend-Only Credentials ───
+  credentials: OAuth2_BackendCredentialsSchema,
+  
+  // ─── Backend Endpoints (extends shared) ───
+  backendEndpoints: OAuth2_BackendEndpointsSchema,
+  
+  // ─── Integration Configuration ───
+  integrations: OAuth2_IntegrationConfigSchema.default(() => ({
+    scopes: {},
+    endpoints: {},
+  })),
+  
+  // ─── Token Management ───
+  tokenManagement: OAuth2_BackendTokenConfigSchema.default(() => ({
+    refreshBeforeExpirySeconds: 300,
+    refreshRetryAttempts: 3,
+    refreshRetryDelayMs: 1000,
+  })),
+  
+  // ─── PKCE Configuration ───
+  pkce: OAuth2_PKCEConfigSchema.default(() => ({
+    enabled: true,
+    codeChallengeMethod: OAuth2_PKCE_Method.S256,
+  })),
+  
+  // ─── Rate Limits ───
+  rateLimits: RateLimitConfigurationSchema,
+  
+  // ─── Capabilities (optional, uses shared schema) ───
+  capabilities: OAuth2_ProviderCapabilitiesSchema.optional(),
+});
+
+// =============================================================================
+// HELPER TYPES FOR GRANT-TYPE SPECIFIC CONFIGURATIONS
+// =============================================================================
+
+/**
+ * Client Credentials Flow Configuration (S2S/Machine-to-Machine)
+ * Used when the backend needs to authenticate as a service, not a user
+ */
+export interface OAuth2_ClientCredentialsConfig {
+  grantType: typeof OAuth2_GrantType.CLIENT_CREDENTIALS;
+  credentials: OAuth2_BackendCredentials;
+  tokenUrl: string;
+  scopes: string[];
+  tokenEndpointAuthMethod: OAuth2_TokenEndpoint_AuthMethod;
+}
+
+/**
+ * JWT Bearer Flow Configuration (Service Accounts)
+ * Used for service accounts that use signed JWTs
+ */
+export interface OAuth2_JWTBearerConfig {
+  grantType: typeof OAuth2_GrantType.JWT_BEARER;
+  credentials: Pick<OAuth2_BackendCredentials, 'serviceAccountEmail' | 'privateKeyPem' | 'keyId'>;
+  tokenUrl: string;
+  scopes: string[];
+  audience: string;
+}

package/src/external-providers/services/__tests__/external-providers-registry.backend.service.test.ts

@@ -0,0 +1,136 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import {
+  CLIRuntime_AuthMode,
+  CLIRuntime_OutputParserMode,
+  CLIRuntime_RunnerHost,
+  CLIRuntime_WorkingDirectoryPolicy,
+  ExternalProvider_ExchangeProtocol_Kind,
+} from '@wildo-ai/external-connectors-models';
+import { ExternalProvidersRegistryBackendService } from '../external-providers-registry.backend.service';
+
+describe('ExternalProvidersRegistryBackendService env-provided secrets', () => {
+  const originalResendApiKey = process.env.RESEND_API_KEY;
+  const originalAnthropicCliKey = process.env.ANTHROPIC_API_KEY_CLI;
+
+  afterEach(() => {
+    if (originalResendApiKey === undefined) {
+      delete process.env.RESEND_API_KEY;
+    } else {
+      process.env.RESEND_API_KEY = originalResendApiKey;
+    }
+
+    if (originalAnthropicCliKey === undefined) {
+      delete process.env.ANTHROPIC_API_KEY_CLI;
+    } else {
+      process.env.ANTHROPIC_API_KEY_CLI = originalAnthropicCliKey;
+    }
+  });
+
+  it('resolves generic provider secrets only from env', async () => {
+    delete process.env.RESEND_API_KEY;
+
+    const service = new ExternalProvidersRegistryBackendService(
+      {
+        debugByType: () => () => undefined,
+        setDebugTypeLogging: () => undefined,
+      } as any,
+      {
+        isInitialized: () => true,
+      } as any,
+      {
+        buildError: (_type: unknown, _details: unknown, config?: { context?: { message?: string } }) =>
+          new Error(config?.context?.message ?? 'error'),
+      } as any,
+      {
+        getProtocol: async (_providerRef: string, protocolKind: ExternalProvider_ExchangeProtocol_Kind) => ({
+          kind: protocolKind,
+          defaultConfiguration: {
+            enabled: true,
+            authConfig: {
+              secretRef: 'RESEND_API_KEY',
+            },
+          },
+        }),
+        getOperations: async () => ({}),
+      } as any,
+      {
+        getComputedRegistry: () => new Map([
+          ['resend', { protocols: [ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER] }],
+        ]),
+      } as any,
+    );
+
+    await service.initialize();
+
+    expect(
+      service.getProviderSecret(
+        'resend',
+        ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER,
+        'RESEND_API_KEY',
+      ),
+    ).toBeUndefined();
+
+    process.env.RESEND_API_KEY = 'env-resend-secret';
+
+    expect(
+      service.getProviderSecret(
+        'resend',
+        ExternalProvider_ExchangeProtocol_Kind.EMAIL_PROVIDER,
+        'RESEND_API_KEY',
+      ),
+    ).toBe('env-resend-secret');
+  });
+
+  it('resolves CLI runtime secrets only from the declared env var', async () => {
+    delete process.env.ANTHROPIC_API_KEY_CLI;
+
+    const service = new ExternalProvidersRegistryBackendService(
+      {
+        debugByType: () => () => undefined,
+        setDebugTypeLogging: () => undefined,
+      } as any,
+      {
+        isInitialized: () => true,
+      } as any,
+      {
+        buildError: (_type: unknown, _details: unknown, config?: { context?: { message?: string } }) =>
+          new Error(config?.context?.message ?? 'error'),
+      } as any,
+      {
+        getProtocol: async (_providerRef: string, protocolKind: ExternalProvider_ExchangeProtocol_Kind) => ({
+          kind: protocolKind,
+          defaultConfiguration: {
+            enabled: true,
+            executionProfiles: {
+              smoke: {
+                runnerHost: CLIRuntime_RunnerHost.BACKEND_SUBPROCESS,
+                command: 'claude',
+                authMode: CLIRuntime_AuthMode.SECRET_REF_ENV_INJECTION,
+                secretRef: 'ANTHROPIC_API_KEY',
+                secretEnvVarName: 'ANTHROPIC_API_KEY_CLI',
+                allowedApplicationEnvironments: ['development'],
+                workspaceRootPath: '/app',
+                workingDirectoryPolicy: CLIRuntime_WorkingDirectoryPolicy.WORKSPACE_ROOT,
+                outputParserMode: CLIRuntime_OutputParserMode.TEXT,
+              },
+            },
+          },
+        }),
+        getOperations: async () => ({}),
+      } as any,
+      {
+        getComputedRegistry: () => new Map([
+          ['anthropic', { protocols: [ExternalProvider_ExchangeProtocol_Kind.CLI_RUNTIME] }],
+        ]),
+      } as any,
+    );
+
+    await service.initialize();
+
+    expect(service.getCLIRuntimeExecutionProfileSecret('anthropic', 'smoke')).toBeUndefined();
+
+    process.env.ANTHROPIC_API_KEY_CLI = 'env-cli-secret';
+
+    expect(service.getCLIRuntimeExecutionProfileSecret('anthropic', 'smoke')).toBe('env-cli-secret');
+  });
+});